rusackas commented on issue #45332: URL: https://github.com/apache/superset/issues/45332#issuecomment-6359210663
Heya @jchong9 and @CodingRookieA, one heads-up on the CSV inline-metadata option before you get too deep into it: `superset/utils/csv.py` already runs every data cell through `escape_value`/`df_to_escaped_csv` to guard against formula injection, so a cell starting with `=`, `@`, `+`, etc. gets neutralized before Excel/Sheets can execute it as a formula. Filter labels and selected values are exactly the kind of free-text, often user-entered strings that protection exists for, so whichever PR implements the inline-comment mode should run the metadata block through that same escaper rather than just concatenating it onto the file. Otherwise it reopens that exact hole in a new code path. On process: feel free to open a draft PR as a proof of concept any time, no need to wait on anything. But since this is an approved SIP, it should also go through the actual SIP process, not just the issue thread: subscribe to the `dev@` mailing list (send any email to [email protected]) and post this as a `[DISCUSS]` thread there so the wider community gets a chance to weigh in before it lands. Lazy consensus applies, so if nothing comes back within the usual window you're clear to move forward, but it needs that thread first to be official. The archive's at https://lists.apache.org/[email protected] if you want to see how these threads usually look. Holler if you want a hand with either. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
