mistercrunch commented on a change in pull request #11704:
URL:
https://github.com/apache/incubator-superset/pull/11704#discussion_r523621792
##########
File path: superset/config.py
##########
@@ -677,6 +677,10 @@ class CeleryConfig: # pylint:
disable=too-few-public-methods
# language. This allows you to define custom logic to process macro template.
CUSTOM_TEMPLATE_PROCESSORS: Dict[str, Type[BaseTemplateProcessor]] = {}
+# Prevent access to classes/objects and proxy methods in the default Jinja
context,
+# unless explicitly overridden by JINJA_CONTEXT_ADDONS or
CUSTOM_TEMPLATE_PROCESSORS.
Review comment:
We may not want to make `JINJA_CONTEXT_ADDONS` mutually exclusive with
`SAFE_JINJA_PROCESSING`. Someone may want to add a safe function to their
environment without having to fully pivot into the legacy/more risky approach.
It should be easy to support this, but we should highlight the caveats.
"""
Exposing functionality through `JINJA_CONTEXT_ADDONS` has security
implications as it opens a window for a user to execute untrusted code. It's
important to make sure that you make sure that the objects exposed (as well as
objects attached to those objets) are harmless. We recommend only exposing
simple/pure functions that return native types.
"""
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
