codeant-ai-for-open-source[bot] commented on code in PR #41780:
URL: https://github.com/apache/superset/pull/41780#discussion_r3680940597
##########
superset/views/core.py:
##########
@@ -919,7 +927,7 @@ def fetch_datasource_metadata(self) -> FlaskResponse:
@expose("/language_pack/<lang>/")
def language_pack(self, lang: str) -> FlaskResponse:
# Only allow expected language formats like "en", "pt_BR", etc.
- if not re.match(r"^[a-z]{2,3}(_[A-Z]{2})?$", lang):
+ if not LANGUAGE_CODE_RE.match(lang):
abort(400, "Invalid language code")
Review Comment:
**Suggestion:** The newly enforced regular expression rejects valid
configured Babel locales that contain multiple subtags, such as `zh_Hant_TW`,
and also applies the restriction to the pre-existing `/language_pack/<lang>/`
endpoint. Since bootstrap locale selection preserves any locale present in
`LANGUAGES`, those deployments can render a non-English page whose
language-pack request returns 400. Validate against the configured/available
catalog path instead of hard-coding only one optional region or script subtag.
[api mismatch]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Custom multi-subtag locales cannot load translations.
- ⚠️ Versioned and legacy language-pack endpoints reject configured locales.
- ⚠️ Affected pages fall back to untranslated or English text.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=a517b04391024cc38a95f0011a1322c4&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=a517b04391024cc38a95f0011a1322c4&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/views/core.py
**Line:** 930:931
**Comment:**
*Api Mismatch: The newly enforced regular expression rejects valid
configured Babel locales that contain multiple subtags, such as `zh_Hant_TW`,
and also applies the restriction to the pre-existing `/language_pack/<lang>/`
endpoint. Since bootstrap locale selection preserves any locale present in
`LANGUAGES`, those deployments can render a non-English page whose
language-pack request returns 400. Validate against the configured/available
catalog path instead of hard-coding only one optional region or script subtag.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41780&comment_hash=b9fcd32d697dbed891a87839e1c32fee047182f4bd5083ac6af528c7f2492358&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41780&comment_hash=b9fcd32d697dbed891a87839e1c32fee047182f4bd5083ac6af528c7f2492358&reaction=dislike'>👎</a>
##########
superset/views/core.py:
##########
@@ -932,6 +940,52 @@ def language_pack(self, lang: str) -> FlaskResponse:
"Language pack doesn't exist on the server", status=404
)
+ @expose("/language_pack/<lang>/<version>/script.js")
+ def language_pack_script(self, lang: str, version: str) -> FlaskResponse:
+ """Serve the language pack as a content-addressed classic script.
+
+ spa.html loads this BEFORE the entry bundle so translations are
+ configured synchronously (no race with code-split chunks), while the
+ versioned URL lets browsers cache the pack as immutable and pick up a
+ fresh copy whenever translations change.
+
+ Deliberately unauthenticated: translation catalogs are static, public
+ content shipped in the Superset repo, contain no user or tenant data,
+ and must load for anonymous principals (login page, embedded).
+ """
+ # Only allow expected language formats like "en", "pt_BR", etc.
+ if not LANGUAGE_CODE_RE.match(lang):
+ abort(400, "Invalid language code")
+ if not re.match(r"^[0-9a-f]{12}$", version):
+ abort(400, "Invalid language pack version")
+
+ current_version: Optional[str] = get_language_pack_version(lang)
+ if current_version is None:
+ return json_error_response(
+ "Language pack doesn't exist on the server", status=404
+ )
+ pack: Optional[dict[str, Any]] = get_language_pack(lang)
+ if pack is None:
+ return json_error_response(
+ "Language pack doesn't exist on the server", status=404
+ )
+
+ response: Response = Response(
+ f"window.__SUPERSET_LANGUAGE_PACK__ = {json.dumps(pack)};",
+ mimetype="application/javascript; charset=utf-8",
+ )
+ if version == current_version:
+ # Content-addressed URL: safe to cache forever.
+ response.cache_control.public = True
+ response.cache_control.max_age = 31536000
Review Comment:
**Suggestion:** `get_language_pack` catches catalog parsing errors and falls
back to the English pack, so this `None` check treats a malformed non-English
catalog as a successful response. The endpoint then serves that English
fallback under the hash of the broken file and may mark it immutable, silently
hiding a deployment/catalog failure and caching incorrect translations for a
year. [logic error]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Broken catalogs silently produce incorrect translations.
- ⚠️ Immutable caches preserve the wrong language pack for one year.
- ⚠️ Deployment failures are hidden from operators and users.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=b7b05ea2f0ab425d8e209f76e0458667&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=b7b05ea2f0ab425d8e209f76e0458667&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/views/core.py
**Line:** 967:980
**Comment:**
*Logic Error: `get_language_pack` catches catalog parsing errors and
falls back to the English pack, so this `None` check treats a malformed
non-English catalog as a successful response. The endpoint then serves that
English fallback under the hash of the broken file and may mark it immutable,
silently hiding a deployment/catalog failure and caching incorrect translations
for a year.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41780&comment_hash=4ee7761c915a78a765fab56917dd40ab442c5ea12cf29c88f5f4e93022edef80&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41780&comment_hash=4ee7761c915a78a765fab56917dd40ab442c5ea12cf29c88f5f4e93022edef80&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
