aminghadersohi commented on code in PR #45575:
URL: https://github.com/apache/superset/pull/45575#discussion_r4366992203
##########
superset/mcp_service/chart/schemas.py:
##########
@@ -6396,16 +6416,24 @@ def _detect_chart_name_sanitization(cls, data: Any) ->
Any:
@field_validator("chart_name")
@classmethod
- def sanitize_chart_name(cls, v: str | None) -> str | None:
- """Sanitize chart name to prevent XSS attacks."""
- try:
- return sanitize_user_input(
- v, "Chart name", max_length=255, allow_empty=True
- )
- except ValueError as ex:
- raise PydanticCustomError(
- "unsafe_text", "{error}", {"error": str(ex)}
- ) from ex
+ def normalize_blank_chart_name(cls, v: str | None) -> str | None:
+ """Keep the optional-name fallback; nonblank names are sanitized
above."""
+ return v if v and v.strip() else None
Review Comment:
Correction to my reply above: the sibling entries
`superset/mcp_service/theme/schemas.py:138` and
`superset/mcp_service/theme/schemas.py:155` — not affected are wrong. This PR
adds `max_length=250` to `CreateThemeRequest.theme_name`, and that cap runs
before `reject_blank_theme_name`, so `create_theme` with `theme_name=" " * 300`
fails with `string_too_long` at `theme_name` at
705c6f0bc395800d6b5fee03d5bef0a9830b1852. Before this PR it got the blank-name
error, and the updated docs say blank `create_theme` names report "Text must
not be empty". The same doc sentence also does not hold for whitespace-only
`metric_name` (`create_dataset_metric` / `update_dataset_metric`, cap 255) or
`update_dataset` `table_name` (cap 250) over their caps; those report
`string_too_long` (that ordering predates this PR). Not fixed yet.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
