aminghadersohi commented on PR #45575: URL: https://github.com/apache/superset/pull/45575#issuecomment-6345936163
@rebenitez1802 I fixed the review-body ask in 6143776c9a761201f4633bcf804243f5901094ce: `>` and NBSP retain their literal text, and valid title lengths are not inflated by escaping. `tests/unit_tests/mcp_service/test_sanitization_warning_inputs.py::test_title_length_counts_plain_text` and `tests/unit_tests/mcp_service/utils/test_sanitization.py::test_filter_value_preserves_greater_than_and_nbsp` fail against the reviewed sanitizer and pass after; the four tool storage/readback tests additionally reproduce 8 failures before and pass after. The full seven-file Docker selection passes: 1,232 tests, using fastmcp 3.4.7 / nh3 0.3.7 / pydantic 2.14.1, with manual/llm_compliance deselected. Each of the six inline asks has its own evidence reply, including the Bullet/Rose follow-up, allowlist hardening, migration note and documentation move. Validation limitation: branch-scoped pre-commit ran; Python checks, frontend lint and formatting passed, but frontend type checking reports missing built declaration outputs (TS6305) and stylelint cannot resolve postcss-styled-syntax in this checkout. Real-LLM checks not run: OpenRouter disabled. Siblings checked: - superset/mcp_service/chart/schemas.py:6369 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (generate/save=false/update chart names). - superset/mcp_service/dashboard/schemas.py:884 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (generate titles). - superset/mcp_service/dashboard/schemas.py:1050 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (update titles). - superset/mcp_service/dashboard/schemas.py:1531 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (duplicate titles). - superset/mcp_service/dashboard/schemas.py:1393 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (certified_by). - superset/mcp_service/dashboard/schemas.py:1414 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (certification_details). - superset/mcp_service/chart/schemas.py:879 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (temporal columns). - superset/mcp_service/chart/schemas.py:1003 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (column names). - superset/mcp_service/chart/schemas.py:1011 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (column labels). - superset/mcp_service/chart/schemas.py:1132 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (filter columns). - superset/mcp_service/chart/schemas.py:1143 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (scalar/list filter values). - superset/mcp_service/chart/schemas.py:1211 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (Gantt columns). - superset/mcp_service/chart/schemas.py:2761 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (Sunburst ranges). - superset/mcp_service/chart/schemas.py:3155 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (pivot comparison periods). - superset/mcp_service/chart/schemas.py:4628 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (Bullet range/marker/marker-line labels). - superset/mcp_service/chart/schemas.py:4637 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (Bullet ranges). - superset/mcp_service/chart/tool/generate_chart.py:255 — fixed in 6143776c9a761201f4633bcf804243f5901094ce (storage/readback regression; schema revalidation carries the sanitized title). - superset/mcp_service/chart/tool/update_chart.py — fixed in 6143776c9a761201f4633bcf804243f5901094ce (storage/readback regression). - superset/mcp_service/dashboard/tool/generate_dashboard.py — fixed in 6143776c9a761201f4633bcf804243f5901094ce (storage/readback regression). - superset/mcp_service/dashboard/tool/update_dashboard.py — fixed in 6143776c9a761201f4633bcf804243f5901094ce (storage/readback regression). - superset/mcp_service/chart/schemas.py:6435 — not affected: Explore links and update_chart_preview have no title field; their config uses the shared field validators above. - superset/mcp_service/dataset/schemas.py — not affected: object names/descriptions do not use this HTML sanitizer; literal-text controls remain covered. - superset/mcp_service/theme/schemas.py — not affected: blank/length validation without HTML stripping. - superset/mcp_service/sql_lab/schemas.py — not affected: label/tab trimming without HTML stripping. - superset/mcp_service/utils/sanitization.py:sanitize_sql_expression — not affected: separate SQL canonicalization, with existing comparison-operator tests. - superset/mcp_service/utils/error_builder.py:54 — not affected: differently named diagnostic scrubber, not a caller of the shared sanitizer. - superset/charts/schemas.py — not affected: REST does not call the MCP sanitizer; the tooltip rendering changes also cover raw text originating in REST/Explore. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
