codeant-ai-for-open-source[bot] commented on code in PR #43504:
URL: https://github.com/apache/superset/pull/43504#discussion_r3858544761
##########
superset/views/base.py:
##########
@@ -812,6 +813,14 @@ def get_spa_template_context(
# No custom URL either, use default SVG
spinner_svg = get_default_spinner_svg()
+ # Serve the spinner as an <img> data URI (see spa.html). SVG loaded via
<img>
+ # can't execute scripts, so rendering doesn't depend on
sanitize_svg_content.
+ spinner_svg_data_uri = None
+ if spinner_svg:
+ spinner_svg_data_uri = "data:image/svg+xml;base64," + base64.b64encode(
+ spinner_svg.encode("utf-8")
+ ).decode("ascii")
Review Comment:
Yes, this is a valid edge case. A malformed persisted or configured theme
can provide a truthy non-string value and cause `.encode()` to raise
`AttributeError`.
Treat only strings as valid SVG content before encoding:
```python
spinner_svg = theme_tokens.get("brandSpinnerSvg")
if not isinstance(spinner_svg, str) or not spinner_svg:
if theme_tokens.get("brandSpinnerUrl"):
spinner_svg = None
else:
spinner_svg = get_default_spinner_svg()
spinner_svg_data_uri = None
if isinstance(spinner_svg, str) and spinner_svg:
spinner_svg_data_uri = "data:image/svg+xml;base64," + base64.b64encode(
spinner_svg.encode("utf-8")
).decode("ascii")
```
This preserves the existing precedence—valid custom SVG, then URL, then the
default spinner—while preventing malformed values from breaking SPA rendering.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
