rusackas commented on code in PR #41780:
URL: https://github.com/apache/superset/pull/41780#discussion_r3685670581
##########
superset/views/core.py:
##########
@@ -932,6 +940,52 @@ def language_pack(self, lang: str) -> FlaskResponse:
"Language pack doesn't exist on the server", status=404
)
+ @expose("/language_pack/<lang>/<version>/script.js")
+ def language_pack_script(self, lang: str, version: str) -> FlaskResponse:
+ """Serve the language pack as a content-addressed classic script.
+
+ spa.html loads this BEFORE the entry bundle so translations are
+ configured synchronously (no race with code-split chunks), while the
+ versioned URL lets browsers cache the pack as immutable and pick up a
+ fresh copy whenever translations change.
+
+ Deliberately unauthenticated: translation catalogs are static, public
+ content shipped in the Superset repo, contain no user or tenant data,
+ and must load for anonymous principals (login page, embedded).
+ """
+ # Only allow expected language formats like "en", "pt_BR", etc.
+ if not LANGUAGE_CODE_RE.match(lang):
+ abort(400, "Invalid language code")
+ if not re.match(r"^[0-9a-f]{12}$", version):
+ abort(400, "Invalid language pack version")
+
+ current_version: Optional[str] = get_language_pack_version(lang)
+ if current_version is None:
+ return json_error_response(
+ "Language pack doesn't exist on the server", status=404
+ )
+ pack: Optional[dict[str, Any]] = get_language_pack(lang)
+ if pack is None:
+ return json_error_response(
+ "Language pack doesn't exist on the server", status=404
+ )
+
+ response: Response = Response(
+ f"window.__SUPERSET_LANGUAGE_PACK__ = {json.dumps(pack)};",
+ mimetype="application/javascript; charset=utf-8",
+ )
+ if version == current_version:
+ # Content-addressed URL: safe to cache forever.
+ response.cache_control.public = True
+ response.cache_control.max_age = 31536000
Review Comment:
Good catch, this was a real bug. `get_language_pack` swallowed catalog parse
failures and silently fell back to the English pack internally, so the `if pack
is None` check right after it was dead code—a broken non-English catalog just
looked like a normal response and could get served under its content-addressed
URL with a one-year immutable cache header.
Fixed in 5d6fc8611: `get_language_pack` now returns `None` on a parse
failure instead of substituting English, so the existing None check actually
fires and 404s. Added coverage for both the util and the route.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
