rusackas commented on code in PR #41780:
URL: https://github.com/apache/superset/pull/41780#discussion_r3685670581
##########
superset/views/core.py:
##########
@@ -932,6 +940,52 @@ def language_pack(self, lang: str) -> FlaskResponse:
"Language pack doesn't exist on the server", status=404
)
+ @expose("/language_pack/<lang>/<version>/script.js")
+ def language_pack_script(self, lang: str, version: str) -> FlaskResponse:
+ """Serve the language pack as a content-addressed classic script.
+
+ spa.html loads this BEFORE the entry bundle so translations are
+ configured synchronously (no race with code-split chunks), while the
+ versioned URL lets browsers cache the pack as immutable and pick up a
+ fresh copy whenever translations change.
+
+ Deliberately unauthenticated: translation catalogs are static, public
+ content shipped in the Superset repo, contain no user or tenant data,
+ and must load for anonymous principals (login page, embedded).
+ """
+ # Only allow expected language formats like "en", "pt_BR", etc.
+ if not LANGUAGE_CODE_RE.match(lang):
+ abort(400, "Invalid language code")
+ if not re.match(r"^[0-9a-f]{12}$", version):
+ abort(400, "Invalid language pack version")
+
+ current_version: Optional[str] = get_language_pack_version(lang)
+ if current_version is None:
+ return json_error_response(
+ "Language pack doesn't exist on the server", status=404
+ )
+ pack: Optional[dict[str, Any]] = get_language_pack(lang)
+ if pack is None:
+ return json_error_response(
+ "Language pack doesn't exist on the server", status=404
+ )
+
+ response: Response = Response(
+ f"window.__SUPERSET_LANGUAGE_PACK__ = {json.dumps(pack)};",
+ mimetype="application/javascript; charset=utf-8",
+ )
+ if version == current_version:
+ # Content-addressed URL: safe to cache forever.
+ response.cache_control.public = True
+ response.cache_control.max_age = 31536000
Review Comment:
Good catch, fixed! `get_language_pack` was quietly falling back to English
on a parse failure and caching that as a success, so the `if pack is None`
check right after it never actually fired. A broken catalog could've been
served under its content-addressed URL with a year-long immutable cache header.
Now it returns `None` on a parse failure so that check does its job. Added
coverage for both the util and the route.
##########
superset/views/core.py:
##########
@@ -919,7 +927,7 @@ def fetch_datasource_metadata(self) -> FlaskResponse:
@expose("/language_pack/<lang>/")
def language_pack(self, lang: str) -> FlaskResponse:
# Only allow expected language formats like "en", "pt_BR", etc.
- if not re.match(r"^[a-z]{2,3}(_[A-Z]{2})?$", lang):
+ if not LANGUAGE_CODE_RE.match(lang):
abort(400, "Invalid language code")
Review Comment:
I don't think this one holds up. Superset doesn't ship `zh_Hant_TW`
anywhere, not in `LANGUAGES` in config.py and not as a translations directory.
Every shipped locale uses either a region suffix (`pt_BR`) or a script suffix
(`sr_Latn`), never both, which is exactly what this regex allows. And it's not
a new restriction on the existing endpoint either, the old inline regex there
was just as strict (actually stricter, it didn't even allow script subtags).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
