n4uu opened a new issue, #43503:
URL: https://github.com/apache/superset/issues/43503
I raised this with the security team first; they confirmed it and see it as
a hardening item (admin-only theme write, non-default config) rather than an
advisory, and suggested opening a public issue and PR.
`spa.html` renders the theme spinner inline with `{{ spinner_svg | safe }}`
(from `brandSpinnerSvg` of the system-default theme, set in
`superset/views/base.py`). The only guard before that raw-HTML sink is
`sanitize_svg_content` in `superset/utils/core.py`, which is a regex denylist
(its docstring: "Basic SVG protection ... trust admin input otherwise").
Regex SVG sanitization is bypassable, and this field is admin-set and
system-default, so it's served to every user, including the logged-out login
page. On deployments that relax CSP (e.g. `TALISMAN_ENABLED = False`), a
sanitizer bypass becomes stored XSS for everyone.
Fix: render the spinner as `<img src="data:image/svg+xml;base64,...">`. An
SVG loaded via `<img>` is a passive image and can't run scripts, so it holds
regardless of contents and doesn't rely on the sanitizer. Same approach the
React `Loading` component already uses. PR incoming.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
