aminghadersohi commented on PR #45485: URL: https://github.com/apache/superset/pull/45485#issuecomment-6305425835
Local end-to-end check at 6d0767aa335d807be0bbd8a3de29e714d805c879, compared with the merge base 7ff5709882fc9005da05a21654e3e2a167b29f70. I ran the Superset web app and the MCP service (`superset mcp run`, `call_tool` over streamable HTTP) with example data, as Admin, Alpha and Gamma users. - Prose titles, e.g. `[DEMO] Service Desk - Executive Summary (substitute data: Jira support tickets)` and `Service Desk (substitute data: Jira, support tickets)`, through generate_dashboard, update_dashboard, generate_chart and update_chart (`chart_name`, `name`, `slice_name`): 36/36 saved for Admin and Alpha at the head, 0/36 at the merge base. They render as plain text in the dashboard header, Explore title, chart list and browser tab at 1366×768 and 1600×1000. - Payload titles (`javascript:`, `vbscript:`, `data:text/html,…`, `data: text/html,…`, NBSP + `image/svg+xml;base64`, `text%2Fhtml`): 216/216 rejected on six servers. The head reports `request.dashboard_title` / `request.chart_name` (aliases included) in 72/72 Admin+Alpha cases; the value is echoed in 0/216 responses. - Filter values: `data:` and `javascript:` payloads are rejected at head and base; the prose value `substitute data: Jira, support` is accepted at head only. - The comma case is fixed in 6d0767aa: after whitespace, `data:` is treated as a URL only when the text before the comma is blank or contains `/`, `;` or `%`. 43 payloads × 2 sanitizers and 200,000 fuzzed inputs against a data-URL model showed no leaks. Limit: `data: Jira/ServiceNow, tickets` is still rejected. - Not changed by this PR, same at the merge base: `dashboard_title: ""` saves an untitled dashboard, while whitespace or null gets a generated title. Rejections give no reason class beyond "Invalid value; check the field schema". - MCP unit suite: 10985 passed. 3 failures in `test_mcp_caching.py::test_catalog_cache_exclusion_survives_revocation` also fail at the merge base. Not covered: natural-language prompts through a real model, a deployed gateway, JWT/API-key auth, PostgreSQL metadata DB.    -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
