GitHub user doidevbiz created a discussion: Bundled legacy Bootstrap static
assets flagged by security scanners
Flask-AppBuilder ships legacy front-end assets under
`flask_appbuilder/static/appbuilder/`. Enterprise security scanners flag Apache
Superset as using assets that are outdated/vulnerable (Bootstrap 3.x line is
end-of-life).
Although the Superset 6.0 release notes state Bootstrap was removed from its
frontend, these concerns block or complicate compliance sign-off for
deployments and therefore reduce the competitiveness of Apache Superset.
### Affected files under flask_appbuilder/static/appbuilder/:
flask_appbuilder/static/appbuilder/css/bootstrap.min.css
flask_appbuilder/static/appbuilder/css/bootstrap.min.css.map
flask_appbuilder/static/appbuilder/js/bootstrap.min.js
flask_appbuilder/static/appbuilder/css/bootstrap-datepicker/bootstrap-datepicker3.min.css
flask_appbuilder/static/appbuilder/js/bootstrap-datepicker/bootstrap-datepicker.min.js
flask_appbuilder/static/appbuilder/css/select2/select2-bootstrap.min.css
**Solution:**
With suggestions from Thomas Richardson on the Slack channel, I did a
workaround as follows:
On a fresh Superset 6.1.0 install, I removed the files listed above and ran
the following:
- Login page: works; no functional errors
- Users list, roles list, and user info pages: work after running
`superset init` (an initial 403 was a permissions-sync issue, unrelated to
the removal)
- Dashboards, charts, SQL Lab, Database connections, etc.
This suggests the assets are not required by the default login flow or by
Superset's security pages in this configuration. I have not tested other
FAB-based applications, other auth types, or FAB's server-rendered ModelViews.
**Positive Impact:**
Restored customers' confidence against competitors like the OEMs, as this was
highlighted as a security minus for Apache Superset.
**Next:**
A permanent fix is strongly recommended: see
https://github.com/dpgaspar/Flask-AppBuilder/issues/2490#issue-5981280604
GitHub link: https://github.com/apache/superset/discussions/45631
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
