mistercrunch commented on a change in pull request #11704:
URL:
https://github.com/apache/incubator-superset/pull/11704#discussion_r523621792
##########
File path: superset/config.py
##########
@@ -677,6 +677,10 @@ class CeleryConfig: # pylint:
disable=too-few-public-methods
# language. This allows you to define custom logic to process macro template.
CUSTOM_TEMPLATE_PROCESSORS: Dict[str, Type[BaseTemplateProcessor]] = {}
+# Prevent access to classes/objects and proxy methods in the default Jinja
context,
+# unless explicitly overridden by JINJA_CONTEXT_ADDONS or
CUSTOM_TEMPLATE_PROCESSORS.
Review comment:
We may not want to make `JINJA_CONTEXT_ADDONS` mutually exclusive with
`SAFE_JINJA_PROCESSING`. Someone may want to add a safe function to their
environment without having to fully pivot into the legacy/more risky approach.
It should be easy to support this, but we should highlight the caveats.
"""
Setting `JINJA_CONTEXT_ADDONS` has security implications as it opens a
window untrusted code to be executed by a user. We recommend that you make sure
that the objects exposed (as well as objects attached to those objets) are 100%
harmless. We recommend only exposing simple/pure functions that return native
types.
"""
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
