n4uu opened a new pull request, #43504:
URL: https://github.com/apache/superset/pull/43504
### SUMMARY
The app/login spinner inlined a theme's `brandSpinnerSvg` with `{{
spinner_svg | safe }}` in `spa.html`, so XSS safety relied entirely on the
regex denylist `sanitize_svg_content`. That field is admin-set and
system-default, shown to every user (including the logged-out login page), and
regex SVG sanitization is bypassable.
This renders the spinner as an `<img src="data:image/svg+xml;base64,...">`
instead. An SVG loaded via `<img>` can't execute scripts, so rendering no
longer depends on the sanitizer. It's the same approach the React `Loading`
component already uses, and the spinner looks identical.
I raised the underlying issue with the security team first; they see it as a
hardening item and suggested a public issue + PR.
### TESTING INSTRUCTIONS
1. Set `ENABLE_UI_THEME_ADMINISTRATION = True`. As admin, create a theme
whose `brandSpinnerSvg` contains a marker (e.g. an `onload=` / `<script>`
payload) and set it as the system default.
2. Load `/login` while logged out. Before: the SVG (with the injected
markup) is inline in the DOM. After: it's an `<img>` data URI with no inline
SVG, and the spinner looks the same.
3. Confirm the default spinner (no custom theme) is unchanged.
Fixes #43503
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
