rusackas commented on PR #39724: URL: https://github.com/apache/superset/pull/39724#issuecomment-5781151437
Heya @FrancescoCastaldi, thanks for sticking with this through so many rounds, the security hardening was careful work. Where I've landed after sitting with it a while: maintaining two translation pipelines isn't worth it, and the `.cmd` wrapper approach here kept reopening a new Windows shell-parsing edge case every time one got closed (sadpandajoe's `%USERNAME%` catch being the latest, still open). Put together #44536, which sidesteps the whole bug class by invoking `node <entry.js>` directly instead of the wrapper, so `cmd.exe` never enters the picture at all. Once that lands I'll close this one out. Appreciate the work you put in here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
