rusackas commented on code in PR #42930:
URL: https://github.com/apache/superset/pull/42930#discussion_r3742517161
##########
superset/commands/dataset/importers/v1/utils.py:
##########
@@ -581,7 +625,12 @@ def load_data(data_uri: str, dataset: SqlaTable, database:
Database) -> None:
validate_data_uri(data_uri)
logger.info("Downloading data from %s", data_uri)
- opener = request.build_opener(_ValidatingRedirectHandler)
+ handlers: list[type[request.BaseHandler]] = [_ValidatingRedirectHandler]
+ if not app.config["DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS"]:
+ # Also enforce the policy at the socket layer: re-check the peer of
+ # every connection, including each redirect hop.
+ handlers.extend([_PeerValidatingHTTPHandler,
_PeerValidatingHTTPSHandler])
+ opener = request.build_opener(*handlers)
data = opener.open(data_uri) # pylint: disable=consider-using-with #
noqa: S310
Review Comment:
Good catch. Disabled proxies on this guarded path so the connection goes
straight to the destination and the peer check validates the real target
instead of a proxy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
