CodeQL flagged a DOM-XSS taint path (js/xss-through-dom) from
DashboardPageIdContext into window.location.href via generateExploreUrl.
Wrap the generated URL in sanitizeUrl(), matching the existing convention
used elsewhere for window.location.href assignments (e.g. ResultSet,
SaveDatasetModal, navigationUtils).
Co-Authored-By: Claude <noreply@anthropic.com>
DatasourceEditor.jsx imported ChartSelect from '../Select/ChartSelect',
which resolves to a nonexistent Datasource/components/Select directory.
ChartSelect actually lives at src/components/Select/ChartSelect, so this
broke module resolution. Flagged in review.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The multi={false} prop was set before the {...rest} spread, so a
caller passing multi through rest props could silently switch
ChartSelect into multi-select mode even though its value/onChange
contract is single-select only. Omit multi from the forwarded prop
type and apply it after the spread so it can't be overridden.
Co-Authored-By: Claude <noreply@anthropic.com>
The early-return null check used `!chartId`, which incorrectly
short-circuits for a falsy but valid chart ID of 0. Use an explicit
null/undefined check instead.
Co-Authored-By: Claude <noreply@anthropic.com>
|| null coerces a falsy chart id (0) to null, silently dropping a
valid drill-through chart selection when saving dataset properties.
Flagged in review.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ModalFooter destructures a closeModal prop and wires it to the footer's
Close button onClick, but DrillDetailModal never passed it when
rendering <ModalFooter />, leaving the Close button a no-op.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
DatasetDrillInfoSchema serializes drill_through_chart_id, but the
drill_info_select_columns list used to load the dataset for
get_drill_info left it out, so the field wasn't fetched on that
query path.
Co-Authored-By: Claude <noreply@anthropic.com>
Addresses a GHAS DOM-text-as-HTML finding on DrillDetailModal.tsx
(window.location.href = url) and a related CWE-20 flag: the dashboard
page id was concatenated into the explore URL unencoded.
Co-Authored-By: Claude <noreply@anthropic.com>
drill_through_chart_id was already included via show_select_columns,
which is spread into show_columns, so re-listing it there created a
duplicate entry as flagged in review.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The lockfile picked up a spurious callsites dedup/nesting diff unrelated
to this PR's dependencies (package.json is unchanged). Confirmed with
mistercrunch in review that this wasn't intentional.
Co-Authored-By: Claude <noreply@anthropic.com>
- Mark drill-to-detail filters with `isExtra: true` in `getFormDataWithDashboardContext`
- Ensures context menu filters (e.g., "drill to details by -> Canada") appear as
dashboard-inherited filters rather than chart-native filters in explore page
- Maintains consistency with filter bar filters which already display correctly
- Updated `getFormDataWithDashboardContext` to accept optional `drillToDetailFilters` parameter
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Make Explore button visible only when drill-through chart is configured
- Change button text from "Edit chart" to "Explore" for clarity
- Fix Explore button to navigate to correct drill-through chart instead of dashboard
- Add proper dashboard context resolution using useDashboardFormData hook
- Use getFormDataWithDashboardContext for proper filter and context mixing
- Simplify StatefulChart rendering with proper formDataOverrides
- Generate explore URLs using getExploreUrl with GET method for reliability
- Add error handling for URL generation with user-friendly toast messages
- Remove duplicate filter conversion logic and use established patterns
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Only show Edit chart button when drill-through chart is configured
- Fix navigation to properly route to explore page instead of dashboard
- Use Button href for same-tab navigation (no target="_blank")
- Add Dataset.id type definition for URL generation
- Update tests to verify link behavior and required dataset properties
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace manual URL construction with SupersetClient's built-in searchParams support.
Rename queryParams prop to searchParams for API alignment and eliminate 12 lines
of URL building logic.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Replace manual URL construction in DrillDetailModal with getExploreUrl utility
- Refactor ChartSelect to derive props from SelectAsyncControl using ComponentProps
- Add comprehensive test coverage for ChartSelect and useDashboardFormData components
- Update DatasourceEditor to use allowClear instead of deprecated clearable prop
- Use rest pattern for better prop forwarding and type safety
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Create DashboardContextFormData type for explicit dashboard context contract
- Add useDashboardFormData hook to encapsulate complex dashboard filter logic
- Simplify DrillDetailPane from 40+ lines to 4 lines using new hook
- Fix Edit Chart link to open drill-through chart instead of original chart
- Ensure StatefulChart inherits dashboard native filters, colors, and context
This ensures drill-through charts get the same dashboard context as regular
dashboard charts, providing consistent filter inheritance and user experience.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Fixes two issues with the drill-through chart configuration:
1. **SelectAsyncControl crash on clear**: Fixed isLabeledValue function to handle null values properly when clearing selections
2. **Missing field in Explore path**: Added drill_through_chart_id to both dataset API response and SqlaTable.data property serialization
This ensures the drill-through chart field loads and saves correctly whether accessed from:
- Datasets CRUD interface
- Explore → Edit Dataset flow
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
