codeant-ai-for-open-source[bot] commented on code in PR #43398:
URL: https://github.com/apache/superset/pull/43398#discussion_r3832081433
##########
superset-frontend/src/pages/SqlLab/LocationContext.tsx:
##########
@@ -41,12 +41,18 @@ export const LocationProvider: FC<{ children?: ReactNode }>
= ({
const queryParams = new URLSearchParams(location.search);
const permalink = location.pathname.match(/\/p\/\w+/)?.[0].slice(3);
if (queryParams.size > 0 || permalink) {
- const autorun = queryParams.get('autorun') === 'true';
+ // SECURITY: never honor `autorun` from the URL querystring. A crafted
+ // cross-site GET link (?dbid=..&sql=..&autorun=true) is a top-level
+ // navigation, so SameSite=Lax cookies are sent and the attacker-chosen
+ // SQL would execute in the victim's session the moment SQL Lab mounts.
+ // Only in-app navigations that pass `location.state` (handled above)
+ // may request autorun; deep links prefill the editor and wait for the
+ // user to press Run.
const isDataset = queryParams.get('isDataset') === 'true';
const queryParamsState = {
requestedQuery: {
...Object.fromEntries(queryParams),
- autorun,
+ autorun: false,
Review Comment:
✅ **Customized review instruction saved!**
**Instruction:**
> Do not flag the CSRF-protected POST bootstrap path as a cross-site autorun
vulnerability; restrict autorun security findings here to forgeable GET-link
paths.
**Applied to:**
- `**/LocationContext.tsx`
---
💡 *To manage or update this instruction, visit: [CodeAnt AI
Settings](https://app.codeant.ai/org/settings/learnings)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
