rusackas commented on PR #42935: URL: https://github.com/apache/superset/pull/42935#issuecomment-5246315479
Thanks @rebenitez1802, and the Medium's accurate. The zero-width strip ran before HTML-entity decoding in all three functions (decoding happens inside `_strip_html_tags` for two of them, an explicit unescape loop in the third), so an entity-encoded zero-width like `​` slipped past the strip, then became the raw character once decoded, right where the keyword checks would've caught it. Fixed by re-running the strip after decoding in all three, plus parametrized tests for the entity-encoded forms and a case confirming a lone entity-encoded U+2028 in plain text still gets silently stripped instead of raising. One wrinkle along the way: mirroring the existing emptiness recheck after the second strip broke `test_sanitize_user_input_xss_entity_encoded`. Turns out `<script>alert(1)</script>` legitimately sanitizes down to `""`, since nh3 strips script content along with the tag, so raising "cannot be empty" there would've been its own regression. Caught it running the full `mcp_service` suite and dropped that specific recheck. Also closed out the four Lows: deduped `MCP_JWT_ISSUER` before counting so `["a", "a"]` isn't read as two issuers, added the `UPDATING.md` entry for the startup-refusal change, and tightened the error message so it says the resolver must actually bind `iss`, not just exist. Pushed as `21fc269f32`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
