ktmud commented on pull request #12315:
URL: https://github.com/apache/superset/pull/12315#issuecomment-755886850


   You may override `preamble.ts` or add a `preambleExtra.ts` for FAB pages. I 
believe it is included in every page we currently have.
   
   At least for Google Analytics, [you have 
to](https://developers.google.com/analytics/devguides/collection/analyticsjs/single-page-applications)
 manually send pageview tracking requests for SPAs:
   
   
![image](https://user-images.githubusercontent.com/335541/103852854-a1b55f00-5061-11eb-96f4-2be3814b169d.png)
   
   And it has its own complexity. 
   
   I just find it hacky to allow Superset admins to inject arbitrary HTML/JS 
tags to the page. It could have security risks as well. Imagine if an attacker 
got access to `app.config` via a Flask vulnerability, they could basically 
inject any content to a Superset page, where as it would be more difficult to 
do so if the overrides are done at the file system level.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
[email protected]



---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to