fix(dashboard): resolve metric Label in Chart Data (View as table) results grid

The dataset drill_info endpoint used to build the results-grid
verbose_map only ever selected/serialized a dataset's columns, never
its metrics. SavedMetric verbose_name (Label) was therefore always
dropped, so a metric's technical name (e.g. sum__num) fell through to
the "View as table" column header even though the chart itself showed
the friendly Label correctly.

Adds metrics.metric_name/verbose_name to the drill_info select columns
and DatasetDrillInfoSchema so the frontend's existing createVerboseMap
logic (which already merges metrics into verbose_map) has data to work
with.

SC-115797

.github/workflows/superset-python-unittest.yml

@@ -75,18 +75,13 @@ jobs:
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
           pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml
-      # COVERAGE_FILE keeps these scoped gates off the default .coverage that
-      # the step above wrote. pytest-cov starts a fresh data file per run, so
-      # without it the last gate replaces the full-suite data and the report
-      # uploaded below contains only that gate's subtree -- every other file
-      # then reads as uncovered, and patch coverage on an unrelated PR is 0%.
       - name: Python 100% coverage unit tests
         env:
           SUPERSET_TESTENV: true
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
-          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.sql" pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
-          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.semantic_layers" pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
+          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
+          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
       - name: Upload code coverage
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:

docs/docs/using-superset/recently-archived.mdx

@@ -11,11 +11,6 @@ When soft-delete is enabled, deleting a chart, dashboard, or dataset archives it
 instead of removing it permanently. The **Recently Archived** view lets owners
 and admins find archived objects and restore them.
 
-A chart used by an alert or report cannot be archived while that dependency
-exists. In the chart list view, the archive confirmation lists the alerts and
-reports that use the chart; a blocked attempt names them and asks you to
-detach or delete them first.
-
 :::note
 
 This view is gated by the `SOFT_DELETE` feature flag. When the flag is off the

superset-frontend/package-lock.json

@@ -86,7 +86,7 @@
         "classnames": "^2.2.5",
         "content-disposition": "^2.0.1",
         "d3-scale": "^4.0.2",
-        "dayjs": "^1.11.22",
+        "dayjs": "^1.11.21",
         "dom-to-image-more": "^3.10.2",
         "dom-to-pdf": "^0.3.2",
         "echarts": "^6.1.0",
@@ -220,7 +220,7 @@
         "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
         "baseline-browser-mapping": "^2.11.14",
         "cheerio": "1.2.0",
-        "concurrently": "^10.0.5",
+        "concurrently": "^10.0.4",
         "copy-webpack-plugin": "^14.0.0",
         "cross-env": "^10.1.0",
         "css-loader": "^7.1.4",
@@ -17190,9 +17190,9 @@
       "license": "MIT"
     },
     "node_modules/concurrently": {
-      "version": "10.0.5",
-      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-10.0.5.tgz",
-      "integrity": "sha512-JaP/CoftUrCcAFW/g//RbgEGwlelnEae6cfBLgH6ZdO6s8jPkn6p9SB9u6pdVxYXoiSnFqseOlHfrEfF82TVOg==",
+      "version": "10.0.4",
+      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-10.0.4.tgz",
+      "integrity": "sha512-trZql+7l/0+WRAsAnEdctr4+iiOS6ZrViI6H8QWcCF9MFS/LT0dKpe8vluB1to6it+OxSI4VospFTIFMW8DJRw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18541,9 +18541,9 @@
       }
     },
     "node_modules/dayjs": {
-      "version": "1.11.22",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.22.tgz",
-      "integrity": "sha512-1YRnxzt/AabP3GHxnaB9/b+ZScCKu5TeF+co+BWG+lnWVIwEcTFc1FVE0WLNmNO3sA6GGXL40i5qkHfbLzpwrg==",
+      "version": "1.11.21",
+      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz",
+      "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==",
       "license": "MIT"
     },
     "node_modules/debounce": {
@@ -34873,18 +34873,12 @@
       }
     },
     "node_modules/react-error-boundary": {
-      "version": "6.1.3",
-      "resolved": "https://registry.npmjs.org/react-error-boundary/-/react-error-boundary-6.1.3.tgz",
-      "integrity": "sha512-GnSKpCohFi2nQmJCWwP8O8wub7zexlePvpsejvQr35vS5RTouS1+utTNOmyc540yw5vyOXnSL1rBWsCQDmkyUA==",
+      "version": "6.1.2",
+      "resolved": "https://registry.npmjs.org/react-error-boundary/-/react-error-boundary-6.1.2.tgz",
+      "integrity": "sha512-3DpCr5HVdZ0caUjYE/kIHBEJN0mNP3ZCgf16c48uJ5TbWjorKVp+YG8W3XqlJ7vJAVNw6wNIImyPXmFydwmyng==",
       "license": "MIT",
       "peerDependencies": {
-        "@types/react": "^18.0.0 || ^19.0.0",
         "react": "^18.0.0 || ^19.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
       }
     },
     "node_modules/react-google-recaptcha": {
@@ -42968,7 +42962,7 @@
         "d3-scale": "^4.0.2",
         "d3-time": "^3.1.0",
         "d3-time-format": "^4.1.0",
-        "dayjs": "^1.11.22",
+        "dayjs": "^1.11.21",
         "dompurify": "^3.4.13",
         "fetch-retry": "^6.0.0",
         "handlebars": "^4.7.9",
@@ -42980,7 +42974,7 @@
         "re-resizable": "^6.11.2",
         "react-ace": "^14.0.1",
         "react-draggable": "^4.7.1",
-        "react-error-boundary": "^6.1.3",
+        "react-error-boundary": "^6.1.2",
         "react-js-cron": "^6.0.2",
         "react-markdown": "^10.1.0",
         "react-resize-detector": "^7.1.2",
@@ -43079,6 +43073,15 @@
         "node": ">=12"
       }
     },
+    "packages/superset-ui-core/node_modules/dompurify": {
+      "version": "3.4.13",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz",
+      "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
+    },
     "packages/superset-ui-core/node_modules/react-ace": {
       "version": "14.0.1",
       "resolved": "https://registry.npmjs.org/react-ace/-/react-ace-14.0.1.tgz",

superset-frontend/package.json

@@ -163,7 +163,7 @@
     "classnames": "^2.2.5",
     "content-disposition": "^2.0.1",
     "d3-scale": "^4.0.2",
-    "dayjs": "^1.11.22",
+    "dayjs": "^1.11.21",
     "dom-to-image-more": "^3.10.2",
     "dom-to-pdf": "^0.3.2",
     "echarts": "^6.1.0",
@@ -297,7 +297,7 @@
     "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
     "baseline-browser-mapping": "^2.11.14",
     "cheerio": "1.2.0",
-    "concurrently": "^10.0.5",
+    "concurrently": "^10.0.4",
     "copy-webpack-plugin": "^14.0.0",
     "cross-env": "^10.1.0",
     "css-loader": "^7.1.4",

superset-frontend/packages/superset-ui-chart-controls/src/components/MetricOption.tsx

@@ -51,20 +51,6 @@ export interface MetricOptionProps {
   shouldShowTooltip?: boolean;
 }
 
-/**
- * `url` is an arbitrary caller-supplied string rendered as an href. Only
- * http(s) and relative URLs become links; other schemes degrade to plain
- * text.
- */
-function isSafeHref(url: string): boolean {
-  try {
-    const { protocol } = new URL(url, window.location.origin);
-    return protocol === 'http:' || protocol === 'https:';
-  } catch {
-    return false;
-  }
-}
-
 export function MetricOption({
   metric,
   labelRef,
@@ -84,7 +70,7 @@ export function MetricOption({
       `}
       ref={labelRef}
     >
-      {url && isSafeHref(url) ? (
+      {url ? (
         <Typography.Link
           href={url}
           target={openInNewWindow ? '_blank' : ''}

superset-frontend/packages/superset-ui-chart-controls/test/components/MetricOption.test.tsx

@@ -112,26 +112,3 @@ test('shows a Tooltip for the verbose metric name', () => {
   const { getByTestId } = setup();
   expect(getByTestId('mock-tooltip')).toBeInTheDocument();
 });
-test('does not render javascript: URLs as links', () => {
-  // Regression test: the url prop can be creator-authored and must
-  // never become a script-bearing href for other viewers.
-  const { queryByRole, getByText } = setup({
-    url: 'javascript:alert(document.domain)', // eslint-disable-line no-script-url
-  });
-  expect(queryByRole('link')).not.toBeInTheDocument();
-  expect(getByText(defaultProps.metric.verbose_name)).toBeInTheDocument();
-});
-test('does not render data: URLs as links', () => {
-  const { queryByRole } = setup({
-    url: 'data:text/html,<script>alert(1)</script>',
-  });
-  expect(queryByRole('link')).not.toBeInTheDocument();
-});
-test('renders relative URLs as links', () => {
-  const { getByRole } = setup({
-    url: '/superset/dashboard/1/',
-  });
-  expect(
-    getByRole('link', { name: defaultProps.metric.verbose_name }),
-  ).toHaveAttribute('href', '/superset/dashboard/1/');
-});

superset-frontend/packages/superset-ui-core/package.json

@@ -67,7 +67,7 @@
     "d3-scale": "^4.0.2",
     "d3-time": "^3.1.0",
     "d3-time-format": "^4.1.0",
-    "dayjs": "^1.11.22",
+    "dayjs": "^1.11.21",
     "dompurify": "^3.4.13",
     "fetch-retry": "^6.0.0",
     "handlebars": "^4.7.9",
@@ -79,7 +79,7 @@
     "re-resizable": "^6.11.2",
     "react-ace": "^14.0.1",
     "react-draggable": "^4.7.1",
-    "react-error-boundary": "^6.1.3",
+    "react-error-boundary": "^6.1.2",
     "react-js-cron": "^6.0.2",
     "react-markdown": "^10.1.0",
     "react-resize-detector": "^7.1.2",

superset-frontend/packages/superset-ui-core/src/time-format/index.ts

@@ -49,6 +49,5 @@ export { default as finestTemporalGrainFormatter } from './formatters/finestTemp
 
 export { default as normalizeTimestamp } from './utils/normalizeTimestamp';
 export { default as denormalizeTimestamp } from './utils/denormalizeTimestamp';
-export { default as createTimeRangeFromGranularity } from './utils/createTimeRangeFromGranularity';
 
 export * from './types';

superset-frontend/packages/superset-ui-core/src/utils/html.test.tsx

@@ -123,25 +123,6 @@ describe('isProbablyHTML', () => {
     expect(isProbablyHTML('<canvas></canvas>')).toBe(true);
     expect(isProbablyHTML('<iframe src="page.html"></iframe>')).toBe(true);
   });
-
-  test('should return true for script-capable and foreign-content tags', () => {
-    expect(isProbablyHTML('<svg onload="alert(1)"></svg>')).toBe(true);
-    expect(isProbablyHTML('<math><mi>x</mi></math>')).toBe(true);
-    expect(
-      isProbablyHTML('<details open ontoggle="alert(1)">x</details>'),
-    ).toBe(true);
-    expect(isProbablyHTML('<summary>x</summary>')).toBe(true);
-    expect(isProbablyHTML('<object data="x"></object>')).toBe(true);
-    expect(isProbablyHTML('<embed src="x">')).toBe(true);
-    expect(isProbablyHTML('<marquee>x</marquee>')).toBe(true);
-    expect(isProbablyHTML('<template>x</template>')).toBe(true);
-    expect(isProbablyHTML('<dialog open>x</dialog>')).toBe(true);
-  });
-
-  test('should return true for elements that parse into document.head', () => {
-    expect(isProbablyHTML('<style>body { display: none; }</style>')).toBe(true);
-    expect(isProbablyHTML('<title>injected</title>')).toBe(true);
-  });
 });
 
 describe('sanitizeHtmlIfNeeded', () => {
@@ -156,24 +137,6 @@ describe('sanitizeHtmlIfNeeded', () => {
     const sanitizedString = sanitizeHtmlIfNeeded(plainText);
     expect(sanitizedString).toEqual(plainText);
   });
-
-  test('should sanitize svg/details/style payloads instead of passing them through', () => {
-    const svgPayload = '<svg onload="alert(document.cookie)"></svg>';
-    const sanitizedSvg = sanitizeHtmlIfNeeded(svgPayload);
-    expect(sanitizedSvg).not.toContain('<svg');
-    expect(sanitizedSvg).not.toContain('onload');
-
-    // `details` (with its `open` attribute) is in js-xss's default
-    // whitelist, so the tag itself survives sanitization; the fix is that
-    // the payload is now routed through FilterXSS at all, which strips the
-    // non-whitelisted `ontoggle` handler instead of returning it verbatim.
-    const detailsPayload = '<details open ontoggle="alert(1)">x</details>';
-    const sanitizedDetails = sanitizeHtmlIfNeeded(detailsPayload);
-    expect(sanitizedDetails).toEqual('<details open>x</details>');
-
-    const stylePayload = '<style>body { display: none; }</style>';
-    expect(sanitizeHtmlIfNeeded(stylePayload)).not.toContain('<style');
-  });
 });
 
 describe('safeHtmlSpan', () => {

superset-frontend/packages/superset-ui-core/src/utils/html.tsx

@@ -154,20 +154,6 @@ const KNOWN_HTML_TAGS = new Set([
   'html',
   'head',
   'body',
-  // Script-capable elements and foreign-content roots (SVG/MathML). These
-  // must be classified as HTML so that downstream sanitization is applied;
-  // omitting them makes the heuristic fail open — payloads such as
-  // `<svg onload=...>` or `<details open ontoggle=...>` would be classified
-  // "not HTML" and returned verbatim by sanitizeHtmlIfNeeded.
-  'svg',
-  'math',
-  'details',
-  'summary',
-  'object',
-  'embed',
-  'marquee',
-  'template',
-  'dialog',
 ]);
 
 const HTML_TAG_PATTERN = new RegExp(
@@ -197,15 +183,10 @@ export function isProbablyHTML(text: string) {
   const parser = new DOMParser();
   const doc = parser.parseFromString(cleanedStr, 'text/html');
 
-  // Check if parsing created actual HTML elements (not just text nodes).
-  // Some elements (e.g. <style>, <title>, <meta>, <link>) parse into
-  // document.head rather than document.body, so both must be inspected —
-  // otherwise a bare <style> payload is classified "not HTML" and skips
-  // sanitization.
-  const elements = [
-    ...Array.from(doc.head.childNodes),
-    ...Array.from(doc.body.childNodes),
-  ].filter(node => node.nodeType === 1) as Element[];
+  // Check if parsing created actual HTML elements (not just text nodes)
+  const elements = Array.from(doc.body.childNodes).filter(
+    node => node.nodeType === 1,
+  ) as Element[];
 
   // If no elements were created, it's not HTML
   if (elements.length === 0) {

superset-frontend/plugins/plugin-chart-ag-grid-table/src/renderers/NumericCellRenderer.tsx

@@ -27,21 +27,11 @@ const StyledTotalCell = styled.div`
   `}
 `;
 
-// `align` originates from the chart's stored column_config
-// (col.config.horizontalAlign), which can be set to an arbitrary string via
-// a direct chart-params API write. Emotion compiles interpolated strings as
-// CSS source, so the value must be clamped to a closed set of keywords
-// before it reaches the stylesheet — never interpolated raw.
-const ALLOWED_ALIGN_VALUES = new Set(['left', 'right', 'center']);
-
-const safeAlign = (align?: string) =>
-  align && ALLOWED_ALIGN_VALUES.has(align) ? align : 'left';
-
 const CellContainer = styled.div<{ backgroundColor?: string; align?: string }>`
   display: flex;
   background-color: ${({ backgroundColor }) =>
     backgroundColor || 'transparent'};
-  justify-content: ${({ align }) => safeAlign(align)};
+  justify-content: ${({ align }) => align || 'left'};
 `;
 
 const ArrowContainer = styled.div<{ arrowColor?: string }>`

superset-frontend/plugins/plugin-chart-ag-grid-table/test/NumericCellRenderer.test.tsx

@@ -1,59 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import '@testing-library/jest-dom';
-import { render } from '@superset-ui/core/spec';
-import { NumericCellRenderer } from '../src/renderers/NumericCellRenderer';
-
-const renderCell = (horizontalAlign?: string) => {
-  const params = {
-    value: 42,
-    valueFormatted: '42',
-    node: { rowPinned: undefined, rowIndex: 0 },
-    hasBasicColorFormatters: false,
-    basicColorFormatters: [],
-    col: {
-      isNumeric: true,
-      config: horizontalAlign ? { horizontalAlign } : {},
-    },
-    valueRange: undefined,
-    alignPositiveNegative: false,
-    colorPositiveNegative: false,
-  } as unknown as Parameters<typeof NumericCellRenderer>[0];
-  return render(<NumericCellRenderer {...params} />);
-};
-
-const collectInjectedCss = () =>
-  Array.from(document.querySelectorAll('style'))
-    .map(style => style.textContent ?? '')
-    .join('\n');
-
-test('applies an allowed horizontalAlign value from column config', () => {
-  const { container } = renderCell('center');
-  expect(container.firstChild).toHaveStyle({ justifyContent: 'center' });
-});
-
-test('does not compile a malicious horizontalAlign into the stylesheet', () => {
-  const payload =
-    'right;} & { position:fixed; top:0; left:0; width:100vw; height:100vh; z-index:99999; background:#fff url(https://attacker.example/beacon) }';
-  const { container } = renderCell(payload);
-  const css = collectInjectedCss();
-  expect(css).not.toContain('position:fixed');
-  expect(css).not.toContain('attacker.example');
-  expect(container.firstChild).toHaveStyle({ justifyContent: 'left' });
-});

superset-frontend/plugins/plugin-chart-calendar/src/utils.ts

@@ -38,11 +38,3 @@ export const convertUTCTimestampToLocal = (utcTimestamp: number): number => {
   const offsetMs = date.getTimezoneOffset() * 60 * 1000;
   return utcTimestamp + offsetMs;
 };
-
-// Escapes HTML special characters before formatter output reaches an
-// innerHTML sink. Mirrors plugin-chart-country-map's escapeHtml.
-export const escapeHtml = (text: unknown): string => {
-  const div = document.createElement('div');
-  div.textContent = String(text);
-  return div.innerHTML;
-};

superset-frontend/plugins/plugin-chart-calendar/src/vendor/cal-heatmap.ts

@@ -13,7 +13,6 @@ import d3tip from 'd3-tip';
 import { t } from '@apache-superset/core/translation';
 import { getContrastingColor } from '@superset-ui/core';
 import { CALENDAR_TOOLTIP_CLASS } from '../tooltip';
-import { escapeHtml } from '../utils';
 
 var d3 = typeof require === 'function' ? require('d3') : window.d3;
 
@@ -23,16 +22,14 @@ var CalHeatMap = function () {
   'use strict';
 
   var self = this;
-  // d3-tip assigns the .html() return value to the tip node via
-  // innerHTML, so formatter output is HTML-escaped first.
   self.tip = d3tip()
     .attr('class', `d3-tip ${CALENDAR_TOOLTIP_CLASS}`)
     .direction('n')
     .offset([-5, 0])
     .html(
       d => `
-      ${escapeHtml(self.options.timeFormatter(d.t))}: <strong>${escapeHtml(
-        self.options.valueFormatter(d.v),
+      ${self.options.timeFormatter(d.t)}: <strong>${self.options.valueFormatter(
+        d.v,
       )}</strong>
     `,
     );
@@ -40,7 +37,7 @@ var CalHeatMap = function () {
     .attr('class', `d3-tip ${CALENDAR_TOOLTIP_CLASS}`)
     .direction('n')
     .offset([-5, 0])
-    .html(d => escapeHtml(self.options.valueFormatter(d)));
+    .html(d => self.options.valueFormatter(d));
 
   this.allowedDataType = ['json', 'csv', 'tsv', 'txt'];
 

superset-frontend/plugins/plugin-chart-calendar/test/cal-heatmap.test.ts

@@ -25,12 +25,8 @@ type FunctionalDateFormat = (date: Date) => string;
 interface CalHeatMapInstance {
   options: {
     dateFormatter: DateFormatter | null;
-    timeFormatter: (t: number) => string;
-    valueFormatter: (v: number) => string;
   };
   formatDate(date: Date, format: string | FunctionalDateFormat): string;
-  tip: { html(): (d: { t: number; v: number }) => string };
-  legendTip: { html(): (d: number) => string };
 }
 
 const CalHeatMap = CalHeatMapImport as unknown as new () => CalHeatMapInstance;
@@ -63,29 +59,3 @@ test('CalHeatMap keeps the D3 formatter fallback', () => {
 
   expect(calendar.formatDate(date, '%B')).toBe('January');
 });
-
-test('cell tooltip HTML escapes creator-controlled formatter output', () => {
-  // Regression test: the tip's .html() callback is assigned to the
-  // tooltip node via innerHTML (d3-tip), so formatter output must be
-  // escaped before it's returned.
-  const calendar = new CalHeatMap();
-  calendar.options.timeFormatter = () => '<img src=x onerror=alert(1)>';
-  calendar.options.valueFormatter = () => '<svg onload=alert(2)>';
-
-  const html = calendar.tip.html()({ t: 0, v: 1 });
-
-  expect(html).not.toContain('<img');
-  expect(html).not.toContain('<svg');
-  expect(html).toContain('&lt;img');
-  expect(html).toContain('&lt;svg');
-});
-
-test('legend tooltip HTML escapes creator-controlled formatter output', () => {
-  const calendar = new CalHeatMap();
-  calendar.options.valueFormatter = () => '<img src=x onerror=alert(1)>';
-
-  const html = calendar.legendTip.html()(1);
-
-  expect(html).not.toContain('<img');
-  expect(html).toContain('&lt;img');
-});

superset-frontend/plugins/plugin-chart-calendar/test/utils.test.ts

@@ -17,11 +17,7 @@
  * under the License.
  */
 
-import {
-  getFormattedUTCTime,
-  convertUTCTimestampToLocal,
-  escapeHtml,
-} from '../src/utils';
+import { getFormattedUTCTime, convertUTCTimestampToLocal } from '../src/utils';
 
 test('getFormattedUTCTime formats local timestamp for display as UTC date', () => {
   const utcTimestamp = 1420070400000; // 2015-01-01 00:00:00 UTC
@@ -91,22 +87,3 @@ test('convertUTCTimestampToLocal and getFormattedUTCTime work together to displa
   const formattedTime = getFormattedUTCTime(localTimestamp, '%Y-%m-%d');
   expect(formattedTime).toContain('2024-01-01');
 });
-
-test('escapeHtml neutralizes markup smuggled through a time format string', () => {
-  // Regression test: d3-time-format passes non-% characters through
-  // verbatim, so escaping must happen before the innerHTML sink.
-  const formatted = getFormattedUTCTime(
-    1704067200000,
-    '%Y <img src=x onerror=alert(1)>',
-  );
-  const escaped = escapeHtml(formatted);
-
-  expect(formatted).toContain('<img');
-  expect(escaped).not.toContain('<img');
-  expect(escaped).toContain('&lt;img');
-});
-
-test('escapeHtml stringifies non-string formatter output safely', () => {
-  expect(escapeHtml(1234)).toEqual('1234');
-  expect(escapeHtml('a & b < c')).toEqual('a &amp; b &lt; c');
-});

superset-frontend/plugins/plugin-chart-cartodiagram/src/util/layerUtil.tsx

@@ -33,27 +33,6 @@ import { WmsLayerConf, WfsLayerConf, LayerConf, XyzLayerConf } from '../types';
 import { isWfsLayerConf, isWmsLayerConf, isXyzLayerConf } from '../typeguards';
 import { isVersionBelow } from './serviceUtil';
 
-/**
- * Escape HTML special characters in a layer attribution string.
- *
- * OpenLayers' Attribution control renders attribution strings via innerHTML,
- * and the attribution here comes from creator-supplied chart form data, so it
- * must be treated as untrusted text rather than markup to prevent stored XSS.
- *
- * @param attribution The attribution string from the layer configuration
- *
- * @returns The attribution with HTML special characters escaped
- */
-export const escapeAttribution = (attribution?: string): string | undefined =>
-  attribution === undefined
-    ? undefined
-    : attribution
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#039;');
-
 /**
  * Create a WMS layer.
  *
@@ -70,7 +49,7 @@ export const createWmsLayer = (wmsLayerConf: WmsLayerConf) => {
         LAYERS: layersParam,
         VERSION: version,
       },
-      attributions: escapeAttribution(attribution),
+      attributions: attribution,
     }),
   });
 };
@@ -87,7 +66,7 @@ export const createXyzLayer = (xyzLayerConf: XyzLayerConf) => {
   return new TileLayer({
     source: new XyzSource({
       url,
-      attributions: escapeAttribution(attribution),
+      attributions: attribution,
     }),
   });
 };
@@ -111,7 +90,7 @@ export const createWfsLayer = async (wfsLayerConf: WfsLayerConf) => {
 
   const wfsSource = new VectorSource({
     format: new GeoJSON(),
-    attributions: escapeAttribution(attribution),
+    attributions: attribution,
     url: extent => {
       const requestUrl = new URL(url);
       const params = requestUrl.searchParams;

superset-frontend/plugins/plugin-chart-cartodiagram/test/util/layerUtil.test.ts

@@ -17,65 +17,20 @@
  * under the License.
  */
 
-import { WfsLayerConf, WmsLayerConf, XyzLayerConf } from '../../src/types';
+import { WfsLayerConf } from '../../src/types';
 import {
   createLayer,
   createWfsLayer,
   createWmsLayer,
   createXyzLayer,
-  escapeAttribution,
 } from '../../src/util/layerUtil';
 
 describe('layerUtil', () => {
-  describe('escapeAttribution', () => {
-    test('escapes HTML markup in attribution strings', () => {
-      expect(escapeAttribution('(c) OSM <img src=x onerror=alert(1)>')).toBe(
-        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
-      );
-      expect(escapeAttribution('a & "b" \'c\'')).toBe(
-        'a &amp; &quot;b&quot; &#039;c&#039;',
-      );
-      expect(escapeAttribution(undefined)).toBeUndefined();
-    });
-  });
-
   describe('createWmsLayer', () => {
     test('exists', () => {
       // function is trivial
       expect(createWmsLayer).toBeDefined();
     });
-
-    test('escapes HTML in the layer attribution', () => {
-      const wmsLayerConf: WmsLayerConf = {
-        title: 'wms',
-        type: 'WMS',
-        url: 'https://ows-demo.terrestris.de/geoserver/osm/wms',
-        version: '1.3.0',
-        layersParam: 'osm:osm-fuel',
-        attribution: '(c) OSM <img src=x onerror=alert(1)>',
-      };
-      const layer = createWmsLayer(wmsLayerConf);
-      const attributions = layer.getSource()?.getAttributions();
-      expect(attributions?.(undefined as never)).toEqual([
-        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
-      ]);
-    });
-  });
-
-  describe('createXyzLayer', () => {
-    test('escapes HTML in the layer attribution', () => {
-      const xyzLayerConf: XyzLayerConf = {
-        title: 'osm',
-        type: 'XYZ',
-        url: 'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
-        attribution: '(c) OSM <img src=x onerror=alert(1)>',
-      };
-      const layer = createXyzLayer(xyzLayerConf);
-      const attributions = layer.getSource()?.getAttributions();
-      expect(attributions?.(undefined as never)).toEqual([
-        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
-      ]);
-    });
   });
 
   describe('createWfsLayer', () => {

superset-frontend/plugins/plugin-chart-echarts/src/Radar/utils.ts

@@ -18,7 +18,6 @@
  */
 import { t } from '@apache-superset/core/translation';
 import { NumberFormatter } from '@superset-ui/core';
-import { sanitizeHtml } from '../utils/series';
 
 /*
  function for finding the max metric values among all series data for Radar Chart
@@ -64,7 +63,7 @@ export const renderNormalizedTooltip = (
   const { color, name = '', value: values } = params;
   const seriesName = name || 'series0';
 
-  const colorDot = `<span style="display:inline-block;margin-right:5px;border-radius:50%;width:5px;height:5px;background-color:${sanitizeHtml(color)}"></span>`;
+  const colorDot = `<span style="display:inline-block;margin-right:5px;border-radius:50%;width:5px;height:5px;background-color:${color}"></span>`;
 
   // Get metric values with denormalization if needed
   const metricValues: TooltipMetricValue[] = metrics.map((metric, index) => {
@@ -86,26 +85,19 @@ export const renderNormalizedTooltip = (
     };
   });
 
-  // Tooltip is rendered via innerHTML (ECharts default renderMode
-  // 'html'), so seriesName/metric/value/color are HTML-escaped, matching
-  // the treatment every other echarts tooltip path applies.
   const tooltipRows = metricValues
     .map(
       ({ metric, value }) => `
         <div style="display:flex;">
-          <div>${colorDot}${sanitizeHtml(metric)}:</div>
-          <div style="font-weight:bold;margin-left:auto;">${sanitizeHtml(
-            String(value),
-          )}</div>
+          <div>${colorDot}${metric}:</div>
+          <div style="font-weight:bold;margin-left:auto;">${value}</div>
         </div>
       `,
     )
     .join('');
 
   return `
-    <div style="font-weight:bold;margin-bottom:5px;">${sanitizeHtml(
-      seriesName,
-    )}</div>
+    <div style="font-weight:bold;margin-bottom:5px;">${seriesName}</div>
     ${tooltipRows}
   `;
 };

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.test.tsx

@@ -21,14 +21,8 @@ import {
   waitFor,
   cleanup,
 } from '../../../../spec/helpers/testing-library';
-import {
-  AxisType,
-  createTimeRangeFromGranularity,
-  DTTM_ALIAS,
-  TimeGranularity,
-} from '@superset-ui/core';
+import { AxisType, TimeGranularity } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
-import { logging } from '@apache-superset/core/utils';
 import type { EChartsCoreOption } from 'echarts/core';
 import type { ECElementEvent } from 'echarts/types/src/util/types';
 import type { ReactNode } from 'react';
@@ -99,17 +93,12 @@ afterAll(() => {
 });
 
 afterEach(() => {
-  jest.useRealTimers();
   cleanup();
   mockEchart.mockReset();
   (globalThis as { ResizeObserver?: typeof ResizeObserver }).ResizeObserver =
     originalResizeObserver;
 });
 
-const advanceClickTimer = () => {
-  jest.advanceTimersByTime(300);
-};
-
 const defaultFormData: EchartsTimeseriesFormData & {
   vizType: string;
   dateFormat: string;
@@ -325,8 +314,7 @@ test('falls back to window resize listener when ResizeObserver is unavailable',
 });
 
 // Test for issue #25334: Bar chart cross-filter without dimensions
-test('emits cross-filter on X-axis value when no dimensions and categorical X-axis', () => {
-  jest.useFakeTimers();
+test('emits cross-filter on X-axis value when no dimensions and categorical X-axis', async () => {
   const setDataMaskMock = jest.fn();
 
   const propsWithCategoricalXAxis: TimeseriesChartTransformedProps = {
@@ -360,7 +348,13 @@ test('emits cross-filter on X-axis value when no dimensions and categorical X-ax
       dataIndex: 0,
     });
 
-    advanceClickTimer();
+    // Wait for the timer (TIMER_DURATION = 300ms)
+    await waitFor(
+      () => {
+        expect(setDataMaskMock).toHaveBeenCalled();
+      },
+      { timeout: 500 },
+    );
 
     // Verify the cross-filter uses the X-axis column and value, not the metric
     const dataMaskCall = setDataMaskMock.mock.calls[0][0];
@@ -374,8 +368,7 @@ test('emits cross-filter on X-axis value when no dimensions and categorical X-ax
   }
 });
 
-test('emits cross-filter on category value for horizontal bar clicks', () => {
-  jest.useFakeTimers();
+test('emits cross-filter on category value for horizontal bar clicks', async () => {
   const setDataMaskMock = jest.fn();
 
   render(
@@ -404,7 +397,12 @@ test('emits cross-filter on category value for horizontal bar clicks', () => {
     dataIndex: 0,
   });
 
-  advanceClickTimer();
+  await waitFor(
+    () => {
+      expect(setDataMaskMock).toHaveBeenCalled();
+    },
+    { timeout: 500 },
+  );
 
   expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
     {
@@ -426,7 +424,9 @@ test('uses rendered categorical axis for query event handlers', () => {
     />,
   );
 
-  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe('xAxis');
+  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe(
+    'xAxis.category',
+  );
 
   cleanup();
   mockEchart.mockReset();
@@ -445,7 +445,9 @@ test('uses rendered categorical axis for query event handlers', () => {
     />,
   );
 
-  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe('yAxis');
+  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe(
+    'yAxis.category',
+  );
 });
 
 test('emits cross-filter from horizontal categorical axis label clicks', () => {
@@ -471,9 +473,8 @@ test('emits cross-filter from horizontal categorical axis label clicks', () => {
     getLatestEchartProps().queryEventHandlers?.[0].handler;
   expect(labelClickHandler).toBeDefined();
   labelClickHandler?.({
-    targetType: 'axisLabel',
     value: 'Product A',
-  } as unknown as ECElementEvent);
+  } as ECElementEvent);
 
   expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
     {
@@ -484,8 +485,7 @@ test('emits cross-filter from horizontal categorical axis label clicks', () => {
   ]);
 });
 
-test('does not emit duplicate cross-filter for generic axis label clicks', () => {
-  jest.useFakeTimers();
+test('does not emit duplicate cross-filter for generic axis label clicks', async () => {
   const setDataMaskMock = jest.fn();
 
   render(
@@ -507,28 +507,11 @@ test('does not emit duplicate cross-filter for generic axis label clicks', () =>
     name: 'Product A',
   });
 
-  jest.advanceTimersByTime(400);
+  await new Promise(resolve => setTimeout(resolve, 400));
   expect(setDataMaskMock).not.toHaveBeenCalled();
 });
 
-test('keeps temporal range exclusive ends on whole-second boundaries', () => {
-  const clickedTimestamp = new Date(Date.UTC(2021, 0, 15, 12, 34, 56, 789));
-
-  [TimeGranularity.DAY, TimeGranularity.MONTH, TimeGranularity.YEAR].forEach(
-    grain => {
-      const [, inclusiveEnd] = createTimeRangeFromGranularity(
-        clickedTimestamp,
-        grain,
-        false,
-      );
-      const exclusiveEnd = new Date(inclusiveEnd.getTime() + 1);
-
-      expect(exclusiveEnd.getUTCMilliseconds()).toBe(0);
-    },
-  );
-});
-
-test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket', () => {
+test('does not emit cross-filter when no dimensions and time-based X-axis', async () => {
   const setDataMaskMock = jest.fn();
 
   const propsWithTimeXAxis: TimeseriesChartTransformedProps = {
@@ -536,610 +519,39 @@ test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket
     emitCrossFilters: true,
     setDataMask: setDataMaskMock,
     groupby: [], // No dimensions
-    resolvedTimeGrain: TimeGranularity.DAY,
-    formData: {
-      ...defaultFormData,
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.DAY,
-    },
     xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
+      label: '__timestamp',
+      type: AxisType.Time, // Time-based X-axis (not categorical)
     },
   };
 
   render(<EchartsTimeseries {...propsWithTimeXAxis} />);
 
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
+  const lastCall = mockEchart.mock.calls.at(-1);
+  expect(lastCall).toBeDefined();
+  const [props] = lastCall as [EchartsProps];
 
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
-    },
-  ]);
-});
+  // Simulate a click event
+  const clickHandler = props.eventHandlers?.click;
+  if (clickHandler) {
+    clickHandler({
+      componentType: 'series',
+      seriesName: 'Sales',
+      data: [1609459200000, 100], // Timestamp
+      name: '2021-01-01',
+      dataIndex: 0,
+    });
 
-test('emits TEMPORAL_RANGE cross-filter from time axis label click on month bucket', () => {
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE cross-filter from time axis label click on year bucket', () => {
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.YEAR}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.YEAR,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2022-01-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits upper-exclusive TEMPORAL_RANGE from time point click on month bucket', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE from string-typed time point click value', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: ['2021-01-01T00:00:00Z', 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('uses resolved time grain for temporal point-click cross-filter', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.DAY,
-        extraFormData: {
-          time_grain_sqla: TimeGranularity.MONTH,
-        },
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE from horizontal time point click using timestamp, not metric', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        orientation: OrientationType.Horizontal,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [129, Date.UTC(2021, 0, 1)],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE cross-filter from horizontal time axis label click', () => {
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        orientation: OrientationType.Horizontal,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'yAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('warns and skips temporal axis label cross-filter when label value cannot be parsed', () => {
-  const setDataMaskMock = jest.fn();
-  const warn = jest.spyOn(logging, 'warn').mockImplementation();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: 'not-a-date',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock).not.toHaveBeenCalled();
-  expect(warn).toHaveBeenCalledWith(
-    'Unable to parse time axis value for cross-filtering',
-    'not-a-date',
-  );
-
-  warn.mockRestore();
-});
-
-test('logs and skips temporal point-click cross-filter when string value cannot be parsed', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-  const warn = jest.spyOn(logging, 'warn').mockImplementation();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: ['not-a-date', 100],
-    name: 'not-a-date',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock).not.toHaveBeenCalled();
-  expect(warn).toHaveBeenCalledWith(
-    'Unable to parse time axis value for cross-filtering',
-    'not-a-date',
-  );
-
-  warn.mockRestore();
-});
-
-test('emits empty temporal X-axis data mask when filter grain is missing', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: undefined,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0]).toEqual({
-    extraFormData: {
-      filters: [],
-    },
-    filterState: {
-      label: undefined,
-      value: null,
-      selectedValues: null,
-    },
-  });
-});
-
-test('clears temporal X-axis cross-filter when clicking selected bucket again', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-  const selectedRange = '2021-01-01T00:00:00 : 2021-02-01T00:00:00';
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      selectedValues={{ 0: selectedRange }}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0]).toEqual({
-    extraFormData: {
-      filters: [],
-    },
-    filterState: {
-      label: undefined,
-      value: null,
-      selectedValues: null,
-    },
-  });
-});
-
-test('does not emit temporal X-axis label cross-filter when dimensions are set', () => {
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={['country']}
-      formData={{
-        ...defaultFormData,
-        groupby: ['country'],
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock).not.toHaveBeenCalled();
-});
-
-test('does not emit temporal X-axis cross-filter when dimensions are set', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={['country']}
-      labelMap={{
-        Sales: ['US'],
-      }}
-      formData={{
-        ...defaultFormData,
-        groupby: ['country'],
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'country',
-      op: 'IN',
-      val: ['US'],
-    },
-  ]);
-  expect(
-    setDataMaskMock.mock.calls[0][0].extraFormData.filters.some(
-      (filter: { op: string }) => filter.op === 'TEMPORAL_RANGE',
-    ),
-  ).toBe(false);
+    // Wait a bit and verify setDataMask was NOT called
+    await new Promise(resolve => setTimeout(resolve, 400));
+    expect(setDataMaskMock).not.toHaveBeenCalled();
+  }
 });
 
 // Test for issue #41102: horizontal bar cross-filter must use the category
 // value, not the metric. For horizontal bars the data tuple is value-first
 // (e.g. [100, 'Product A']), so relying on data[0] emitted the metric value.
-test('emits cross-filter on the category value for a horizontal categorical bar', () => {
-  jest.useFakeTimers();
+test('emits cross-filter on the category value for a horizontal categorical bar', async () => {
   const setDataMaskMock = jest.fn();
 
   const propsWithHorizontalXAxis: TimeseriesChartTransformedProps = {
@@ -1173,7 +585,12 @@ test('emits cross-filter on the category value for a horizontal categorical bar'
       dataIndex: 0,
     });
 
-    advanceClickTimer();
+    await waitFor(
+      () => {
+        expect(setDataMaskMock).toHaveBeenCalled();
+      },
+      { timeout: 500 },
+    );
 
     // Must filter on the category ('Product A'), not the metric value (100)
     const dataMaskCall = setDataMaskMock.mock.calls[0][0];
@@ -1187,55 +604,6 @@ test('emits cross-filter on the category value for a horizontal categorical bar'
   }
 });
 
-test('context menu cross-filter is available for a temporal bar point', async () => {
-  const onContextMenuMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      onContextMenu={onContextMenuMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.DAY,
-        extraFormData: {
-          time_grain_sqla: TimeGranularity.MONTH,
-        },
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const contextMenuHandler = getLatestEchartProps().eventHandlers?.contextmenu;
-  expect(contextMenuHandler).toBeDefined();
-  await contextMenuHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
-  });
-
-  await waitFor(() => {
-    expect(onContextMenuMock).toHaveBeenCalled();
-  });
-
-  const { crossFilter } = onContextMenuMock.mock.calls[0][2];
-  expect(crossFilter.dataMask.extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
 // Test for issue #41102: the context-menu ("Add cross-filter") path must also
 // use the category value, not the metric, for a horizontal categorical bar.
 test('context menu cross-filter uses the category value for a horizontal categorical bar', async () => {

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.tsx

@@ -21,17 +21,14 @@ import {
   DTTM_ALIAS,
   BinaryQueryObjectFilterClause,
   AxisType,
-  type TimeGranularity,
   getTimeFormatter,
   getColumnLabel,
   getNumberFormatter,
   LegendState,
   ensureIsArray,
-  createTimeRangeFromGranularity,
 } from '@superset-ui/core';
 import { useTheme } from '@apache-superset/core/theme';
 import { GenericDataType } from '@apache-superset/core/common';
-import { logging } from '@apache-superset/core/utils';
 import type {
   ECElementEvent,
   ViewRootGroup,
@@ -51,29 +48,6 @@ import { getTemporalXAxisDrillByFilter } from '../utils/xAxisDrillByFilter';
 import { ExtraControls } from '../components/ExtraControls';
 
 const TIMER_DURATION = 300;
-const getTimestampFromTimeAxisValue = (value: string | number) => {
-  if (typeof value === 'number') {
-    return Number.isFinite(value) ? value : undefined;
-  }
-  const timestamp = Date.parse(value);
-  if (Number.isNaN(timestamp)) {
-    logging.warn('Unable to parse time axis value for cross-filtering', value);
-  }
-  return Number.isNaN(timestamp) ? undefined : timestamp;
-};
-
-// Day, month, and year ranges end at 23:59:59.999, so adding 1ms lands on a
-// whole-second next bucket boundary. The formatter intentionally emits seconds.
-const formatDateTime = (date: Date) =>
-  `${[
-    date.getUTCFullYear(),
-    String(date.getUTCMonth() + 1).padStart(2, '0'),
-    String(date.getUTCDate()).padStart(2, '0'),
-  ].join('-')}T${[
-    String(date.getUTCHours()).padStart(2, '0'),
-    String(date.getUTCMinutes()).padStart(2, '0'),
-    String(date.getUTCSeconds()).padStart(2, '0'),
-  ].join(':')}`;
 
 // Percent-change draggable baseline handle geometry, in pixels.
 const BASELINE_HANDLE_WIDTH = 8;
@@ -97,7 +71,6 @@ export default function EchartsTimeseries({
   onFocusedSeries,
   xValueFormatter,
   xAxis,
-  resolvedTimeGrain,
   refs,
   emitCrossFilters,
   coltypeMapping,
@@ -390,65 +363,6 @@ export default function EchartsTimeseries({
     [selectedValues, xAxis.label],
   );
 
-  const getTimeAxisCrossFilterDataMask = useCallback(
-    (clickedTimestamp: number) => {
-      const filterColumn =
-        xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
-      const grain = resolvedTimeGrain as TimeGranularity | undefined;
-
-      if (!filterColumn || !grain) {
-        return {
-          dataMask: {
-            extraFormData: {
-              filters: [],
-            },
-            filterState: {
-              label: undefined,
-              value: null,
-              selectedValues: null,
-            },
-          },
-          isCurrentValueSelected: false,
-        };
-      }
-
-      const [start, inclusiveEnd] = createTimeRangeFromGranularity(
-        new Date(clickedTimestamp),
-        grain,
-        false,
-      );
-      const exclusiveEnd = new Date(inclusiveEnd.getTime() + 1);
-      const timeRange = `${formatDateTime(start)} : ${formatDateTime(exclusiveEnd)}`;
-      const selected: string[] = Object.values(selectedValues);
-      const isCurrentValueSelected = selected.includes(timeRange);
-      const values = isCurrentValueSelected ? [] : [timeRange];
-
-      return {
-        dataMask: {
-          extraFormData: {
-            filters:
-              values.length === 0
-                ? []
-                : [
-                    {
-                      col: filterColumn,
-                      op: 'TEMPORAL_RANGE' as const,
-                      val: timeRange,
-                    },
-                  ],
-          },
-          filterState: {
-            label: values.length ? values : undefined,
-            value: values.length ? values : null,
-            selectedValues: values.length ? values : null,
-          },
-        },
-        isCurrentValueSelected,
-      };
-    },
-    [formData.granularitySqla, resolvedTimeGrain, selectedValues, xAxis.label],
-  );
-
   const handleChange = useCallback(
     (value: string) => {
       if (!emitCrossFilters) {
@@ -470,26 +384,15 @@ export default function EchartsTimeseries({
     [emitCrossFilters, setDataMask, getXAxisCrossFilterDataMask],
   );
 
-  const handleTimeAxisChange = useCallback(
-    (clickedTimestamp: number) => {
-      if (!emitCrossFilters) {
-        return;
-      }
-      setDataMask(getTimeAxisCrossFilterDataMask(clickedTimestamp).dataMask);
-    },
-    [emitCrossFilters, setDataMask, getTimeAxisCrossFilterDataMask],
-  );
-
   // Determine if X-axis can be used for cross-filtering (categorical axis without dimensions)
   const canCrossFilterByXAxis =
-    !hasDimensions &&
-    (xAxis.type === AxisType.Category || xAxis.type === AxisType.Time);
-  const xAxisValueIndex =
+    !hasDimensions && xAxis.type === AxisType.Category;
+  const categoryAxisValueIndex =
     formData.orientation === OrientationType.Horizontal ? 1 : 0;
-  const getXAxisValue = useCallback(
+  const getCategoryAxisValue = useCallback(
     (data: unknown, name: unknown) => {
       if (Array.isArray(data)) {
-        const categoryAxisValue = data[xAxisValueIndex];
+        const categoryAxisValue = data[categoryAxisValueIndex];
         if (
           typeof categoryAxisValue === 'string' ||
           typeof categoryAxisValue === 'number'
@@ -502,7 +405,7 @@ export default function EchartsTimeseries({
       }
       return undefined;
     },
-    [xAxisValueIndex],
+    [categoryAxisValueIndex],
   );
 
   const eventHandlers: EventHandlers = {
@@ -520,28 +423,15 @@ export default function EchartsTimeseries({
           // Cross-filter by dimension (original behavior)
           const { seriesName: name } = props;
           handleChange(name);
-        } else if (
-          canCrossFilterByXAxis &&
-          xAxis.type === AxisType.Category &&
-          props.componentType === 'series'
-        ) {
+        } else if (canCrossFilterByXAxis && props.componentType === 'series') {
           // Cross-filter by X-axis value when no dimensions (issue #25334)
-          const categoryAxisValue = getXAxisValue(props.data, props.name);
+          const categoryAxisValue = getCategoryAxisValue(
+            props.data,
+            props.name,
+          );
           if (categoryAxisValue !== undefined) {
             handleXAxisChange(categoryAxisValue);
           }
-        } else if (
-          canCrossFilterByXAxis &&
-          xAxis.type === AxisType.Time &&
-          props.componentType === 'series'
-        ) {
-          const timeAxisValue = getXAxisValue(props.data, props.name);
-          if (timeAxisValue !== undefined) {
-            const timestamp = getTimestampFromTimeAxisValue(timeAxisValue);
-            if (timestamp !== undefined) {
-              handleTimeAxisChange(timestamp);
-            }
-          }
         }
       }, TIMER_DURATION);
     },
@@ -576,20 +466,17 @@ export default function EchartsTimeseries({
         ];
         const groupBy = ensureIsArray(formData.groupby);
         if (data && xAxis.type === AxisType.Time) {
-          const timeAxisValue = getXAxisValue(data, eventParams.name);
-          if (timeAxisValue !== undefined) {
-            drillToDetailFilters.push({
-              col:
-                // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
-                xAxis.label === DTTM_ALIAS
-                  ? formData.granularitySqla
-                  : xAxis.label,
-              grain: resolvedTimeGrain,
-              op: '==',
-              val: timeAxisValue,
-              formattedVal: xValueFormatter(timeAxisValue),
-            });
-          }
+          drillToDetailFilters.push({
+            col:
+              // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
+              xAxis.label === DTTM_ALIAS
+                ? formData.granularitySqla
+                : xAxis.label,
+            grain: formData.timeGrainSqla,
+            op: '==',
+            val: data[0],
+            formattedVal: xValueFormatter(data[0]),
+          });
         }
         [
           ...(xAxis.type === AxisType.Category && data ? [xAxis.label] : []),
@@ -630,7 +517,9 @@ export default function EchartsTimeseries({
           xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
         if (data && xAxis.type === AxisType.Time && xAxisCol) {
           // For horizontal orientation the [x, value] pair is swapped
-          const xValue = Array.isArray(data) ? data[xAxisValueIndex] : data;
+          const xValue = Array.isArray(data)
+            ? data[categoryAxisValueIndex]
+            : data;
           const xAxisFilter = getTemporalXAxisDrillByFilter(
             xAxisCol,
             xValue,
@@ -641,7 +530,10 @@ export default function EchartsTimeseries({
             xAxisFilters.push(xAxisFilter);
           }
         } else if (xAxis.type === AxisType.Category && xAxisCol) {
-          const categoryAxisValue = getXAxisValue(data, eventParams.name);
+          const categoryAxisValue = getCategoryAxisValue(
+            data,
+            eventParams.name,
+          );
           if (categoryAxisValue !== undefined) {
             // A category axis can still sit on a temporal column when the
             // axis is forced categorical; filter by time bucket in that case
@@ -672,25 +564,15 @@ export default function EchartsTimeseries({
           crossFilter = getCrossFilterDataMask(seriesName);
         } else if (
           canCrossFilterByXAxis &&
-          xAxis.type === AxisType.Category &&
           eventParams.componentType === 'series'
         ) {
-          const categoryAxisValue = getXAxisValue(data, eventParams.name);
+          const categoryAxisValue = getCategoryAxisValue(
+            data,
+            eventParams.name,
+          );
           if (categoryAxisValue !== undefined) {
             crossFilter = getXAxisCrossFilterDataMask(categoryAxisValue);
           }
-        } else if (
-          canCrossFilterByXAxis &&
-          xAxis.type === AxisType.Time &&
-          eventParams.componentType === 'series'
-        ) {
-          const timeAxisValue = getXAxisValue(data, eventParams.name);
-          if (timeAxisValue !== undefined) {
-            const timestamp = getTimestampFromTimeAxisValue(timeAxisValue);
-            if (timestamp !== undefined) {
-              crossFilter = getTimeAxisCrossFilterDataMask(timestamp);
-            }
-          }
         }
 
         onContextMenu(pointerEvent.clientX, pointerEvent.clientY, {
@@ -711,39 +593,26 @@ export default function EchartsTimeseries({
       const { value } = event;
       if (
         canCrossFilterByXAxis &&
-        event.targetType === 'axisLabel' &&
         (typeof value === 'string' || typeof value === 'number')
       ) {
-        if (xAxis.type === AxisType.Time) {
-          const timestamp = getTimestampFromTimeAxisValue(value);
-          if (timestamp !== undefined) {
-            handleTimeAxisChange(timestamp);
-          }
-        } else {
-          handleXAxisChange(value);
-        }
+        handleXAxisChange(value);
       }
     },
-    [
-      canCrossFilterByXAxis,
-      handleTimeAxisChange,
-      handleXAxisChange,
-      xAxis.type,
-    ],
+    [canCrossFilterByXAxis, handleXAxisChange],
   );
 
-  const renderedXAxis =
+  const categoryAxis =
     formData.orientation === OrientationType.Horizontal ? 'yAxis' : 'xAxis';
 
   const queryEventHandlers = useMemo(
     () => [
       {
         name: 'click',
-        query: renderedXAxis,
+        query: `${categoryAxis}.category`,
         handler: handleXAxisLabelClick,
       },
     ],
-    [renderedXAxis, handleXAxisLabelClick],
+    [categoryAxis, handleXAxisLabelClick],
   );
 
   const zrEventHandlers: EventHandlers = {

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/transformProps.ts

@@ -1248,7 +1248,7 @@ export default function transformProps(
     name: xAxisTitle,
     nameGap: convertInteger(xAxisTitleMargin),
     nameLocation: 'middle',
-    ...((xAxisType === AxisType.Category || xAxisType === AxisType.Time) &&
+    ...(xAxisType === AxisType.Category &&
       groupBy.length === 0 && {
         triggerEvent: true,
       }),
@@ -1600,7 +1600,6 @@ export default function transformProps(
       label: xAxisLabel,
       type: xAxisType,
     },
-    resolvedTimeGrain,
     refs,
     coltypeMapping: dataTypes,
     onLegendScroll,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/types.ts

@@ -122,6 +122,5 @@ export type TimeseriesChartTransformedProps =
         label: string;
         type: AxisType;
       };
-      resolvedTimeGrain?: TimeGranularity;
       onFocusedSeries: (series: string | null) => void;
     };

superset-frontend/plugins/plugin-chart-echarts/src/utils/eChartOptionsSchema.ts

@@ -28,7 +28,6 @@
  */
 
 import { z } from 'zod';
-import { sanitizeHtml } from '@superset-ui/core';
 
 // =============================================================================
 // Common Schemas
@@ -58,33 +57,6 @@ const fontStyleSchema = z.enum(['normal', 'italic', 'oblique']);
 /** Symbol type */
 const symbolTypeSchema = z.string();
 
-/**
- * With the ECharts default renderMode 'html', a string tooltip formatter is
- * assigned to the tooltip DOM element via innerHTML. ECharts formatter
- * strings commonly rely on inline markup (e.g. '{b}<br/>{c}') for layout, so
- * rejecting every '<' would break that supported usage; instead the value is
- * run through the same allowlist sanitizer used for other tooltip HTML,
- * which keeps presentational tags and strips anything else.
- */
-const sanitizedFormatterSchema = z
-  .string()
-  .transform(value => sanitizeHtml(value));
-
-/**
- * ECharts navigates to title.link/sublink on click, so restrict them to
- * http(s) and same-origin relative paths.
- */
-const safeLinkSchema = z
-  .string()
-  .refine(
-    value =>
-      /^https?:\/\//i.test(value) ||
-      (value.startsWith('/') && !value.startsWith('//')),
-    {
-      message: 'Only http(s) or same-origin relative URLs are allowed',
-    },
-  );
-
 // =============================================================================
 // Text Style Schema
 // =============================================================================
@@ -196,11 +168,11 @@ export const titleSchema = z.object({
   id: z.string().optional(),
   show: z.boolean().optional(),
   text: z.string().optional(),
-  link: safeLinkSchema.optional(),
+  link: z.string().optional(),
   target: z.enum(['self', 'blank']).optional(),
   textStyle: textStyleSchema.optional(),
   subtext: z.string().optional(),
-  sublink: safeLinkSchema.optional(),
+  sublink: z.string().optional(),
   subtarget: z.enum(['self', 'blank']).optional(),
   subtextStyle: textStyleSchema.optional(),
   textAlign: z.enum(['left', 'center', 'right']).optional(),
@@ -414,9 +386,7 @@ export const tooltipSchema = z.object({
       z.array(z.union([z.number(), z.string()])),
     ])
     .optional(),
-  // Only string formatters: a string tooltip formatter is rendered via
-  // innerHTML (default renderMode 'html'), so it is sanitized above.
-  formatter: sanitizedFormatterSchema.optional(),
+  formatter: z.string().optional(), // Only string formatters
   padding: z.union([z.number(), z.array(z.number())]).optional(),
   backgroundColor: colorSchema.optional(),
   borderColor: colorSchema.optional(),
@@ -427,9 +397,7 @@ export const tooltipSchema = z.object({
   shadowOffsetX: z.number().optional(),
   shadowOffsetY: z.number().optional(),
   textStyle: textStyleSchema.optional(),
-  // `extraCssText` is intentionally not accepted; unknown keys are
-  // stripped by the schema, so configs that still carry it keep working
-  // minus the raw CSS.
+  extraCssText: z.string().optional(),
   order: z
     .enum(['seriesAsc', 'seriesDesc', 'valueAsc', 'valueDesc'])
     .optional(),
@@ -607,9 +575,6 @@ export const seriesSchema = z.object({
   polarIndex: z.number().optional(),
   geoIndex: z.number().optional(),
   calendarIndex: z.number().optional(),
-  // Per-series `tooltip` is intentionally not admitted; the schema
-  // strips unknown keys. If per-series tooltips are ever admitted, reuse
-  // tooltipSchema so the formatter sanitization applies.
   label: labelSchema.optional(),
   labelLine: z
     .object({

superset-frontend/plugins/plugin-chart-echarts/src/utils/safeEChartOptionsParser.test.ts

@@ -523,73 +523,3 @@ test('EChartOptionsParseError contains validation error details', () => {
     );
   }
 });
-
-// =============================================================================
-// Creator-authored options must not reach the tooltip's innerHTML/
-// navigation sinks unsanitized.
-// =============================================================================
-
-test('sanitizes tooltip string formatters instead of rejecting all markup', () => {
-  const input = `{ tooltip: { formatter: '<img src=x onerror=alert(1)>' } }`;
-  const result = parseEChartOptions(input);
-
-  expect(result.success).toBe(true);
-  expect(result.data?.tooltip).toEqual({ formatter: '<img src>' });
-});
-
-test('keeps presentational tags in tooltip string formatters', () => {
-  const input = `{ tooltip: { formatter: '{b}<br/>{c}' } }`;
-  const result = parseEChartOptions(input);
-
-  expect(result.success).toBe(true);
-  expect(result.data?.tooltip).toEqual({ formatter: '{b}<br />{c}' });
-});
-
-test('strips per-series tooltip config so its formatter never reaches the merge', () => {
-  const result = parseEChartOptions(
-    `{ series: [{ type: 'line', tooltip: { formatter: '<b onpointerover=alert(1)>x</b>' } }] }`,
-  );
-
-  expect(result.success).toBe(true);
-  expect(result.data).toEqual({ series: [{ type: 'line' }] });
-});
-
-test('accepts markup-free tooltip placeholder formatters', () => {
-  const input = `{ tooltip: { formatter: '{b}: {c}' } }`;
-  const result = parseEChartOptions(input);
-
-  expect(result.success).toBe(true);
-  expect(result.data).toEqual({ tooltip: { formatter: '{b}: {c}' } });
-});
-
-test('rejects javascript: URLs in title link and sublink', () => {
-  expect(() =>
-    parseEChartOptions(`{ title: { link: 'javascript:alert(1)' } }`),
-  ).toThrow(EChartOptionsParseError);
-  expect(() =>
-    parseEChartOptions(`{ title: { sublink: 'javascript:alert(1)' } }`),
-  ).toThrow(EChartOptionsParseError);
-  expect(() =>
-    parseEChartOptions(`{ title: { link: '//evil.example/x' } }`),
-  ).toThrow(EChartOptionsParseError);
-});
-
-test('accepts http(s) and same-origin relative title links', () => {
-  const result = parseEChartOptions(
-    `{ title: { link: 'https://superset.apache.org', sublink: '/dashboard/1/' } }`,
-  );
-
-  expect(result.success).toBe(true);
-  expect(result.data).toEqual({
-    title: { link: 'https://superset.apache.org', sublink: '/dashboard/1/' },
-  });
-});
-
-test('strips tooltip extraCssText instead of passing raw CSS through', () => {
-  const result = parseEChartOptions(
-    `{ tooltip: { show: true, extraCssText: 'background:url(//evil.example/x)' } }`,
-  );
-
-  expect(result.success).toBe(true);
-  expect(result.data).toEqual({ tooltip: { show: true } });
-});

superset-frontend/plugins/plugin-chart-echarts/test/Radar/utils.test.ts

@@ -70,42 +70,4 @@ describe('renderNormalizedTooltip', () => {
     expect(tooltip).toContain('N/A');
     expect(tooltip).not.toContain('NaN');
   });
-
-  test('should HTML-escape series names from query data', () => {
-    // Regression test: the tooltip is rendered via innerHTML, so markup
-    // in query-result values must not become live DOM.
-    const tooltip = renderNormalizedTooltip(
-      { ...params, name: '<img src=x onerror=alert(1)>' },
-      metrics,
-      mockGetDenormalizedValue,
-      metricsWithCustomBounds,
-    );
-    expect(tooltip).not.toContain('<img');
-    expect(tooltip).toContain('&lt;img');
-  });
-
-  test('should HTML-escape metric labels', () => {
-    const tooltip = renderNormalizedTooltip(
-      params,
-      ['<svg onload=alert(1)>', 'metric2'],
-      mockGetDenormalizedValue,
-      metricsWithCustomBounds,
-    );
-    expect(tooltip).not.toContain('<svg');
-    expect(tooltip).toContain('&lt;svg');
-  });
-
-  test('should HTML-escape the series color used for the tooltip color dot', () => {
-    // Regression test: `color` is interpolated into a style attribute
-    // unquoted, so an unescaped quote could break out of the attribute
-    // and inject markup.
-    const tooltip = renderNormalizedTooltip(
-      { ...params, color: 'red" onmouseover="alert(1)' },
-      metrics,
-      mockGetDenormalizedValue,
-      metricsWithCustomBounds,
-    );
-    expect(tooltip).not.toContain('" onmouseover="alert(1)"');
-    expect(tooltip).toContain('&quot; onmouseover=&quot;alert(1)');
-  });
 });

superset-frontend/plugins/plugin-chart-echarts/test/Timeseries/EchartsTimeseries.test.tsx

@@ -16,17 +16,11 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { render, waitFor } from '@testing-library/react';
-import { AxisType, DTTM_ALIAS, TimeGranularity } from '@superset-ui/core';
+import { render } from '@testing-library/react';
+import { AxisType } from '@superset-ui/core';
 import { supersetTheme, ThemeProvider } from '@apache-superset/core/theme';
-import { logging } from '@apache-superset/core/utils';
-import type { ECElementEvent } from 'echarts/types/src/util/types';
 import EchartsTimeseries from '../../src/Timeseries/EchartsTimeseries';
-import {
-  OrientationType,
-  TimeseriesChartTransformedProps,
-} from '../../src/Timeseries/types';
-import type { EchartsProps } from '../../src/types';
+import { TimeseriesChartTransformedProps } from '../../src/Timeseries/types';
 
 // Percent-change draggable baseline: this is the one piece of the ECharts
 // rebuilds with zero prior test coverage despite six separate production
@@ -46,14 +40,12 @@ let mockChart: {
   convertFromPixel: jest.Mock;
   getModel: jest.Mock;
 };
-const mockEchart = jest.fn();
 
 jest.mock('../../src/components/Echart', () => {
   const { forwardRef, useImperativeHandle } = jest.requireActual('react');
   return {
     __esModule: true,
-    default: forwardRef((props: unknown, ref: unknown) => {
-      mockEchart(props);
+    default: forwardRef((_props: unknown, ref: unknown) => {
       useImperativeHandle(ref, () => ({
         getEchartInstance: () => mockChart,
       }));
@@ -123,17 +115,6 @@ function renderTimeseries(
   );
 }
 
-function getLatestEchartProps() {
-  const lastCall = mockEchart.mock.calls.at(-1);
-  expect(lastCall).toBeDefined();
-  const [props] = lastCall as [EchartsProps];
-  return props;
-}
-
-function advanceClickTimer() {
-  jest.advanceTimersByTime(300);
-}
-
 // Pulls the graphic descriptor for the draggable baseline handle out of the
 // most recent setOption call, mirroring how ECharts itself would read it.
 function getBaselineGraphic() {
@@ -145,7 +126,6 @@ function getBaselineGraphic() {
 
 beforeEach(() => {
   jest.clearAllMocks();
-  mockEchart.mockReset();
   setupChartMock();
   jest.spyOn(window, 'requestAnimationFrame').mockImplementation(cb => {
     cb(0);
@@ -154,7 +134,6 @@ beforeEach(() => {
 });
 
 afterEach(() => {
-  jest.useRealTimers();
   jest.restoreAllMocks();
 });
 
@@ -266,400 +245,3 @@ test('does not touch the chart instance when rebase is disabled', () => {
 
   expect(mockChart.setOption).not.toHaveBeenCalled();
 });
-
-test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket', () => {
-  const setDataMask = jest.fn();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: [],
-    resolvedTimeGrain: TimeGranularity.DAY,
-    formData: {
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.DAY,
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMask.mock.calls[0][0]).toEqual({
-    extraFormData: {
-      filters: [
-        {
-          col: 'ds',
-          op: 'TEMPORAL_RANGE',
-          val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
-        },
-      ],
-    },
-    filterState: {
-      label: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
-      value: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
-      selectedValues: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
-    },
-  });
-});
-
-test('emits upper-exclusive TEMPORAL_RANGE from time point click on month bucket', () => {
-  jest.useFakeTimers();
-  const setDataMask = jest.fn();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: [],
-    resolvedTimeGrain: TimeGranularity.MONTH,
-    formData: {
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.MONTH,
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  getLatestEchartProps().eventHandlers?.click?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-  advanceClickTimer();
-
-  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('uses resolved time grain for temporal point-click cross-filter', () => {
-  jest.useFakeTimers();
-  const setDataMask = jest.fn();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: [],
-    resolvedTimeGrain: TimeGranularity.MONTH,
-    formData: {
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.DAY,
-      extraFormData: {
-        time_grain_sqla: TimeGranularity.MONTH,
-      },
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  getLatestEchartProps().eventHandlers?.click?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-  advanceClickTimer();
-
-  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE from string-typed time point click value', () => {
-  jest.useFakeTimers();
-  const setDataMask = jest.fn();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: [],
-    resolvedTimeGrain: TimeGranularity.MONTH,
-    formData: {
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.MONTH,
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  getLatestEchartProps().eventHandlers?.click?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: ['2021-01-01T00:00:00Z', 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-  advanceClickTimer();
-
-  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE from horizontal time point click using timestamp, not metric', () => {
-  jest.useFakeTimers();
-  const setDataMask = jest.fn();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: [],
-    resolvedTimeGrain: TimeGranularity.MONTH,
-    formData: {
-      orientation: OrientationType.Horizontal,
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.MONTH,
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  getLatestEchartProps().eventHandlers?.click?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [129, Date.UTC(2021, 0, 1)],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-  advanceClickTimer();
-
-  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('clears temporal X-axis cross-filter when clicking selected bucket again', () => {
-  jest.useFakeTimers();
-  const setDataMask = jest.fn();
-  const selectedRange = '2021-01-01T00:00:00 : 2021-02-01T00:00:00';
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: [],
-    selectedValues: { 0: selectedRange },
-    resolvedTimeGrain: TimeGranularity.MONTH,
-    formData: {
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.MONTH,
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  getLatestEchartProps().eventHandlers?.click?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-  advanceClickTimer();
-
-  expect(setDataMask.mock.calls[0][0]).toEqual({
-    extraFormData: {
-      filters: [],
-    },
-    filterState: {
-      label: undefined,
-      value: null,
-      selectedValues: null,
-    },
-  });
-});
-
-test('emits empty temporal X-axis data mask when filter grain is missing', () => {
-  jest.useFakeTimers();
-  const setDataMask = jest.fn();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: [],
-    formData: {
-      granularitySqla: 'ds',
-      timeGrainSqla: undefined,
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  getLatestEchartProps().eventHandlers?.click?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-  advanceClickTimer();
-
-  expect(setDataMask.mock.calls[0][0]).toEqual({
-    extraFormData: {
-      filters: [],
-    },
-    filterState: {
-      label: undefined,
-      value: null,
-      selectedValues: null,
-    },
-  });
-});
-
-test('warns and skips temporal cross-filter when string value cannot be parsed', () => {
-  jest.useFakeTimers();
-  const setDataMask = jest.fn();
-  const warn = jest.spyOn(logging, 'warn').mockImplementation();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: [],
-    resolvedTimeGrain: TimeGranularity.MONTH,
-    formData: {
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.MONTH,
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  getLatestEchartProps().eventHandlers?.click?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: ['not-a-date', 100],
-    name: 'not-a-date',
-    dataIndex: 0,
-  });
-  advanceClickTimer();
-
-  expect(setDataMask).not.toHaveBeenCalled();
-  expect(warn).toHaveBeenCalledWith(
-    'Unable to parse time axis value for cross-filtering',
-    'not-a-date',
-  );
-});
-
-test('does not emit temporal X-axis label cross-filter when dimensions are set', () => {
-  const setDataMask = jest.fn();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    setDataMask,
-    groupby: ['country'],
-    formData: {
-      groupby: ['country'],
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.MONTH,
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMask).not.toHaveBeenCalled();
-});
-
-test('context menu cross-filter is available for a temporal bar point', async () => {
-  const onContextMenu = jest.fn();
-
-  renderTimeseries({
-    emitCrossFilters: true,
-    onContextMenu,
-    groupby: [],
-    resolvedTimeGrain: TimeGranularity.MONTH,
-    formData: {
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.DAY,
-      extraFormData: {
-        time_grain_sqla: TimeGranularity.MONTH,
-      },
-      vizType: 'echarts_timeseries_line',
-    } as any,
-    xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
-    },
-  });
-
-  await getLatestEchartProps().eventHandlers?.contextmenu?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
-  });
-
-  await waitFor(() => {
-    expect(onContextMenu).toHaveBeenCalled();
-  });
-
-  const { crossFilter } = onContextMenu.mock.calls[0][2];
-  expect(crossFilter.dataMask.extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});

superset-frontend/plugins/plugin-chart-echarts/test/Timeseries/transformProps.test.ts

@@ -2083,39 +2083,6 @@ test('xAxisForceCategorical forces Category axis regardless of Numeric coltype',
   expect(xAxis.triggerEvent).toBe(true);
 });
 
-test('temporal x-axis enables trigger events when no dimensions are set', () => {
-  const ts1 = 1745784000000;
-  const ts2 = 1745870400000;
-  const chartProps = createTestChartProps({
-    formData: {
-      metrics: ['metric'],
-      granularity_sqla: 'ds',
-      x_axis: '__timestamp',
-    },
-    queriesData: [
-      createTestQueryData(
-        [
-          { __timestamp: ts1, metric: 10 },
-          { __timestamp: ts2, metric: 20 },
-        ],
-        {
-          colnames: ['__timestamp', 'metric'],
-          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
-        },
-      ),
-    ],
-  });
-
-  const { echartOptions } = transformProps(chartProps);
-  const xAxis = echartOptions.xAxis as {
-    triggerEvent?: boolean;
-    type: string;
-  };
-
-  expect(xAxis.type).toBe(AxisType.Time);
-  expect(xAxis.triggerEvent).toBe(true);
-});
-
 test('temporal x coltype forced categorical yields a Category axis with date labels', () => {
   // Issue #28204: with a temporal x-axis (e.g. weekly grain) the default Time
   // scale places ticks at "nice" intervals that don't line up with the buckets.
@@ -2363,7 +2330,6 @@ test('tooltip time grain wiring: dashboard-level extraFormData time grain overri
   });
 
   const transformedProps = transformProps(chartProps);
-  expect(transformedProps.resolvedTimeGrain).toBe(TimeGranularity.MONTH);
   const tooltipFormatter = (
     transformedProps.echartOptions as unknown as TooltipFormatterOptions
   ).tooltip.formatter;
@@ -2397,7 +2363,6 @@ test('tooltip time grain wiring: chart-level time grain drives the tooltip when
   });
 
   const transformedProps = transformProps(chartProps);
-  expect(transformedProps.resolvedTimeGrain).toBe(TimeGranularity.YEAR);
   const tooltipFormatter = (
     transformedProps.echartOptions as unknown as TooltipFormatterOptions
   ).tooltip.formatter;

superset-frontend/plugins/plugin-chart-world-map/src/WorldMap.ts

@@ -80,19 +80,6 @@ interface DatamapSource {
   country?: string;
 }
 
-/**
- * Escape HTML special characters to prevent XSS attacks. Popup templates are
- * assigned to the hover element via innerHTML by the datamaps library, and
- * formatter output can echo a creator-controlled format string verbatim
- * (see createD3NumberFormatter's invalid-format fallback), so both the name
- * and the formatted value must be treated as untrusted text.
- */
-function escapeHtml(text: string): string {
-  const div = document.createElement('div');
-  div.textContent = text;
-  return div.innerHTML;
-}
-
 const propTypes = {
   data: PropTypes.arrayOf(
     PropTypes.shape({
@@ -292,9 +279,9 @@ function WorldMap(element: HTMLElement, props: WorldMapProps): void {
       highlightBorderWidth: 1,
       popupTemplate: (geo, d) =>
         d &&
-        `<div class="hoverinfo"><strong>${escapeHtml(
-          d.name,
-        )}</strong><br>${escapeHtml(String(formatter(d.m1)))}</div>`,
+        `<div class="hoverinfo"><strong>${d.name}</strong><br>${formatter(
+          d.m1,
+        )}</div>`,
     },
     bubblesConfig: {
       borderWidth: 1,
@@ -303,9 +290,9 @@ function WorldMap(element: HTMLElement, props: WorldMapProps): void {
       popupOnHover: !inContextMenu,
       radius: null,
       popupTemplate: (geo, d) =>
-        `<div class="hoverinfo"><strong>${escapeHtml(
-          d.name,
-        )}</strong><br>${escapeHtml(String(formatter(d.m2)))}</div>`,
+        `<div class="hoverinfo"><strong>${d.name}</strong><br>${formatter(
+          d.m2,
+        )}</div>`,
       fillOpacity: 0.5,
       animate: true,
       highlightOnHover: !inContextMenu,

superset-frontend/plugins/plugin-chart-world-map/test/WorldMap.test.ts

@@ -180,33 +180,6 @@ test('disables Datamaps highlightOnHover while the context menu is open', () =>
   expect(geographyConfig?.highlightOnHover).toBe(false);
 });
 
-test('escapes markup in hover popup templates', () => {
-  // Regression test for stored XSS via the number-formatter fallback: an
-  // invalid Y Axis Format string is echoed verbatim by the formatter
-  // (createD3NumberFormatter's catch branch), so the popup templates must
-  // HTML-escape formatter output before datamaps assigns it via innerHTML.
-  const maliciousFormatter = getNumberFormatter('<img src=x onerror=alert(1)>');
-  WorldMap(container, { ...baseProps, formatter: maliciousFormatter });
-
-  const geographyConfig = lastDatamapConfig?.geographyConfig as {
-    popupTemplate: (geo: unknown, d: unknown) => string;
-  };
-  const bubblesConfig = lastDatamapConfig?.bubblesConfig as {
-    popupTemplate: (geo: unknown, d: unknown) => string;
-  };
-  const entry = { name: '<b>United States</b>', m1: 100, m2: 200 };
-
-  const geoPopup = geographyConfig.popupTemplate({}, entry);
-  const bubblePopup = bubblesConfig.popupTemplate({}, entry);
-
-  [geoPopup, bubblePopup].forEach(popup => {
-    expect(popup).not.toContain('<img');
-    expect(popup).not.toContain('<b>');
-    expect(popup).toContain('&lt;img src=x onerror=alert(1)&gt;');
-    expect(popup).toContain('&lt;b&gt;United States&lt;/b&gt;');
-  });
-});
-
 test('does not throw error when onContextMenu is undefined', () => {
   const propsWithoutContextMenu = {
     ...baseProps,

superset-frontend/src/SqlLab/actions/sqlLab.ts

@@ -1524,9 +1524,7 @@ export function popPermalink(key: string): SqlLabThunkAction<Promise<unknown>> {
             dbId: json.dbId ? parseInt(json.dbId, 10) : undefined,
             catalog: json.catalog ?? null,
             schema: json.schema ?? undefined,
-            // The recipient must review the prefilled query and press
-            // Run; a permalink payload never auto-runs.
-            autorun: false,
+            autorun: json.autorun ? json.autorun : false,
             sql: json.sql ? json.sql : 'SELECT ...',
             templateParams: json.templateParams,
           }),
@@ -1550,9 +1548,7 @@ export function popStoredQuery(
             dbId: json.dbId ? parseInt(json.dbId, 10) : undefined,
             catalog: json.catalog ?? null,
             schema: json.schema ?? undefined,
-            // Same rule as popPermalink above — stored payloads never
-            // auto-run.
-            autorun: false,
+            autorun: json.autorun ? json.autorun : false,
             sql: json.sql ? json.sql : 'SELECT ...',
             templateParams: json.templateParams,
           }),
@@ -1631,9 +1627,7 @@ export function popDatasourceQuery(
             name: `${QUERY_TEXT} ${json.result.name}`,
             dbId: json.result.database.id,
             schema: json.result.schema,
-            // `sql` here can come straight from the URL, so its mere
-            // presence must never imply auto-execution.
-            autorun: false,
+            autorun: sql !== undefined,
             sql: sql || json.result.select_star,
           }),
         ),

superset-frontend/src/SqlLab/components/ResultSet/index.tsx

@@ -719,7 +719,7 @@ const ResultSet = ({
     if (data && data.length > 0) {
       const allowHTML = getItem(
         LocalStorageKeys.SqllabIsRenderHtmlEnabled,
-        false,
+        true,
       );
 
       const tableProps = {

superset-frontend/src/SqlLab/components/SqlEditor/index.tsx

@@ -284,7 +284,7 @@ const SqlEditor: FC<Props> = ({
     getItem(LocalStorageKeys.SqllabIsAutocompleteEnabled, true),
   );
   const [renderHTMLEnabled, setRenderHTMLEnabled] = useState(
-    getItem(LocalStorageKeys.SqllabIsRenderHtmlEnabled, false),
+    getItem(LocalStorageKeys.SqllabIsRenderHtmlEnabled, true),
   );
   const [showCreateAsModal, setShowCreateAsModal] = useState(false);
   const [createAs, setCreateAs] = useState('');

superset-frontend/src/components/Datasource/components/DatasourceEditor/DatasourceEditor.tsx

@@ -1993,6 +1993,7 @@ function DatasourceEditor({
                           col => col.column_name,
                         )}
                         height={300}
+                        allowHTML
                       />
                     </>
                   )}

superset-frontend/src/components/FilterableTable/index.tsx

@@ -63,7 +63,7 @@ export const FilterableTable = ({
   height,
   filterText = '',
   expandedColumns = [],
-  allowHTML = false,
+  allowHTML = true,
   striped,
   themeOverrides,
 }: FilterableTableProps) => {

superset-frontend/src/components/FilterableTable/utils.test.tsx

@@ -64,35 +64,6 @@ test('should render cellData value for default cell data', () => {
   expect(container).toHaveTextContent('regular_text');
 });
 
-test('should render HTML cell data as inert text by default', () => {
-  const { container } = render(
-    <>
-      {renderResultCell({
-        cellData: '<img src="https://attacker.example/beacon.gif" />link',
-        columnKey: 'a',
-      })}
-    </>,
-  );
-  expect(container.querySelector('img')).not.toBeInTheDocument();
-  expect(container).toHaveTextContent(
-    '<img src="https://attacker.example/beacon.gif" />link',
-  );
-});
-
-test('should render sanitized HTML only when allowHTML is explicitly enabled', () => {
-  const { container } = render(
-    <>
-      {renderResultCell({
-        cellData: '<b>bold</b>',
-        columnKey: 'a',
-        allowHTML: true,
-      })}
-    </>,
-  );
-  expect(container.querySelector('b')).toBeInTheDocument();
-  expect(container).toHaveTextContent('bold');
-});
-
 test('should transform cell data by getCellContent for the regular text', () => {
   const { container } = render(
     <>

superset-frontend/src/components/FilterableTable/utils.tsx

@@ -32,15 +32,11 @@ type Params = CellParams & {
   getCellContent?: (args: CellParams) => string;
 };
 
-// Result cells carry untrusted warehouse data, so HTML rendering is opt-in:
-// even sanitized markup keeps active capabilities (img/video fetch beacons,
-// phishing anchors), which must not activate by default for data the viewer
-// did not author.
 export const renderResultCell = ({
   cellData,
   getCellContent,
   columnKey,
-  allowHTML = false,
+  allowHTML = true,
 }: Params) => {
   const cellNode =
     getCellContent?.({ cellData, columnKey }) ?? String(cellData);

superset-frontend/src/constants.test.ts

@@ -1,31 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import {
-  URL_PARAMS,
-  RESERVED_CHART_URL_PARAMS,
-  RESERVED_DASHBOARD_URL_PARAMS,
-} from 'src/constants';
-
-test('permalinkKey is reserved on both the chart and dashboard URL param lists', () => {
-  // Dashboard and explore permalinks resolve against different backend
-  // KV resources/salts, so a key from one must never leak into the other's
-  // URL via the reserved-params passthrough logic.
-  expect(RESERVED_DASHBOARD_URL_PARAMS).toContain(URL_PARAMS.permalinkKey.name);
-  expect(RESERVED_CHART_URL_PARAMS).toContain(URL_PARAMS.permalinkKey.name);
-});

superset-frontend/src/constants.ts

@@ -123,7 +123,6 @@ export const RESERVED_CHART_URL_PARAMS: string[] = [
   URL_PARAMS.datasourceId.name,
   URL_PARAMS.datasourceType.name,
   URL_PARAMS.datasetId.name,
-  URL_PARAMS.permalinkKey.name,
   URL_PARAMS.versionHistory.name,
 ];
 export const RESERVED_DASHBOARD_URL_PARAMS: string[] = [

superset-frontend/src/dashboard/util/permissionUtils.test.ts

@@ -259,21 +259,6 @@ describe('isUserEditorOrAdmin', () => {
   test('returns false when editors is omitted', () => {
     expect(isUserEditorOrAdmin(outsiderUser)).toEqual(false);
   });
-
-  test('returns true when the user is granted editorship only through extra_editors', () => {
-    expect(isUserEditorOrAdmin(editorUser, [], [10])).toEqual(true);
-  });
-
-  test('unions editors and extra_editors rather than preferring one', () => {
-    const nonMatchingSubject: Subject = { id: 999, label: 'Other', type: 1 };
-    expect(isUserEditorOrAdmin(editorUser, [nonMatchingSubject], [10])).toEqual(
-      true,
-    );
-  });
-
-  test('returns false when extra_editors names other subjects', () => {
-    expect(isUserEditorOrAdmin(editorUser, [], [999])).toEqual(false);
-  });
 });
 
 // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks

superset-frontend/src/dashboard/util/permissionUtils.ts

@@ -55,6 +55,9 @@ export const isUserInSubjects = (
   );
 };
 
+const isUserInEditors = (editors: Subject[] = []): boolean =>
+  isUserInSubjects(editors);
+
 export const isUserAdmin = (
   user?: UserWithPermissionsAndRoles | UndefinedUser,
 ) =>
@@ -63,12 +66,10 @@ export const isUserAdmin = (
     role => role.toLowerCase() === ADMIN_ROLE_NAME.toLowerCase(),
   );
 
-/** `extraEditors` is editorship granted via a deployment's EXTRA_EDITORS_RESOLVER. */
 export const isUserEditorOrAdmin = (
   user?: UserWithPermissionsAndRoles | UndefinedUser,
   editors: Subject[] = [],
-  extraEditors?: SubjectRef[] | null,
-): boolean => isUserInSubjects(editors, extraEditors) || isUserAdmin(user);
+): boolean => isUserInEditors(editors) || isUserAdmin(user);
 
 /**
  * Editorship of *dashboard*, matching the server's `is_editor`: the explicit

superset-frontend/src/explore/components/DataTablesPane/components/useGridResultTable.tsx

@@ -19,6 +19,7 @@
 import { useMemo, useCallback, useRef, useState } from 'react';
 import {
   getTimeFormatter,
+  safeHtmlSpan,
   TimeFormats,
   getMetricLabel,
   QueryFormMetric,
@@ -91,11 +92,8 @@ export function useGridColumns(
                   ) {
                     return timeFormatter(value);
                   }
-                  // Render string cells as plain text: this grid shows raw
-                  // query results (untrusted warehouse data) to any viewer,
-                  // so HTML must stay inert here even after sanitization.
                   if (typeof value === 'string') {
-                    return value;
+                    return safeHtmlSpan(value);
                   }
                   return String(value);
                 },

superset-frontend/src/explore/components/controls/ColorBreakpointsControl/ColorBreakpointOption.test.tsx

@@ -112,31 +112,6 @@ describe('ColorBreakpointOption', () => {
     expect(colorPreview).toBeInTheDocument();
   });
 
-  test('should coerce non-numeric color channels instead of injecting CSS', async () => {
-    // Stored form_data is opaque JSON, so a saved chart can carry a string
-    // channel crafted to break out of the styled-component declaration.
-    const maliciousBreakpoint = {
-      id: 3,
-      color: {
-        r: '0,0,0,1); } body { display: none } .x { background: rgba(0' as unknown as number,
-        g: 0,
-        b: 0,
-        a: 1,
-      },
-      minValue: 0,
-      maxValue: 100,
-    };
-
-    renderComponent({ breakpoint: maliciousBreakpoint });
-
-    const colorPreview = await screen.findByTestId('color-preview');
-    expect(colorPreview).toBeInTheDocument();
-    // The malicious string is coerced to a safe numeric channel (0), so the
-    // rendered rule is a plain rgba() value with no injected CSS.
-    expect(colorPreview).toHaveStyle({ background: 'rgba(0, 0, 0, 1)' });
-    expect(document.body).toBeVisible();
-  });
-
   test('should handle decimal values', async () => {
     const decimalBreakpoint: ColorBreakpointType = {
       id: 2,

superset-frontend/src/explore/components/controls/ColorBreakpointsControl/ColorBreakpointOption.tsx

@@ -31,19 +31,6 @@ const BreakpointColorPreview = styled.div`
   margin-right: ${({ theme }) => theme.sizeUnit}px;
 `;
 
-// Chart params are stored server-side as opaque JSON, so breakpoint color
-// channels can arrive as arbitrary strings despite the compile-time numeric
-// type. The formatted color is interpolated into a styled-component template
-// (a stylesheet, not a per-property style assignment), so each channel must
-// be coerced to a plain number to keep attacker-controlled strings from
-// injecting CSS rules.
-const toRgbChannel = (channel: unknown): number => {
-  const value = Number(channel);
-  return Number.isFinite(value)
-    ? Math.min(255, Math.max(0, Math.round(value)))
-    : 0;
-};
-
 const ColorBreakpointOption = ({
   breakpoint,
   colorBreakpoints,
@@ -54,9 +41,7 @@ const ColorBreakpointOption = ({
   const { color, minValue, maxValue } = breakpoint;
 
   const formattedColor = color
-    ? `rgba(${toRgbChannel(color.r)}, ${toRgbChannel(color.g)}, ${toRgbChannel(
-        color.b,
-      )}, 1)`
+    ? `rgba(${color.r}, ${color.g}, ${color.b}, 1)`
     : '';
 
   return (

superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/index.tsx

@@ -78,37 +78,6 @@ import { useExploreDataExport } from './useExploreDataExport';
 
 export const SEARCH_THRESHOLD = 10;
 
-/**
- * Escape a single CSV cell value.
- *
- * Mirrors the server-side chokepoint (superset/utils/csv.py escape_value):
- * values starting with a spreadsheet formula prefix (=, +, -, @, |, %, or a
- * leading tab/carriage return, optionally behind leading whitespace) are
- * neutralized with a leading single quote so exported cells cannot execute
- * as formulas when opened in Excel/LibreOffice/Google Sheets. Plain negative
- * numbers are left untouched. RFC-4180 quoting is applied afterwards.
- */
-export const escapeCsvValue = (v: unknown): string => {
-  if (v === null || v === undefined) return '';
-  let s = String(v);
-  if (s.length > 0) {
-    const stripped = s.replace(/^\s+/, '');
-    const startsLikeFormula =
-      s[0] === '\t' ||
-      s[0] === '\r' ||
-      (stripped.length > 0 && '-@+|=%'.includes(stripped[0]));
-    const isNegativeNumber = s.length > 1 && /^-[0-9.]+$/.test(s);
-    if (startsLikeFormula && !isNegativeNumber) {
-      // Escape pipe to be extra safe (DDE payloads), then prefix with a
-      // single quote to prevent formula evaluation. Existing backslashes
-      // must be escaped first so the resulting `\|`/`\\` sequences are
-      // unambiguous to a downstream unescaper.
-      s = `'${s.replace(/\\/g, '\\\\').replace(/\|/g, '\\|')}`;
-    }
-  }
-  return /[",\r\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
-};
-
 const MENU_KEYS = {
   EDIT_PROPERTIES: 'edit_properties',
   DASHBOARDS_ADDED_TO: 'dashboards_added_to',
@@ -519,11 +488,15 @@ export const useExploreAdditionalActionsMenu = (
     filename: string,
   ) => {
     if (!rows?.length || !columns?.length) return;
-    const header = columns
-      .map(c => escapeCsvValue(c.label ?? c.key ?? ''))
-      .join(',');
+    const esc = (v: unknown): string => {
+      if (v === null || v === undefined) return '';
+      const s = String(v);
+      const wrapped = /[",\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
+      return wrapped;
+    };
+    const header = columns.map(c => esc(c.label ?? c.key ?? '')).join(',');
     const body = rows
-      .map(r => columns.map(c => escapeCsvValue(r[c.key])).join(','))
+      .map(r => columns.map(c => esc(r[c.key])).join(','))
       .join('\n');
     const csv = `${header}\n${body}`;
     const blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' });

superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/useExploreAdditionalActionsMenu.test.tsx

@@ -25,7 +25,6 @@ import downloadAsPdf from 'src/utils/downloadAsPdf';
 import {
   useExploreAdditionalActionsMenu,
   getExportScreenshotMenuItems,
-  escapeCsvValue,
 } from './index';
 import * as exploreUtils from 'src/explore/exploreUtils';
 import { Slice } from 'src/types/Chart';
@@ -181,45 +180,6 @@ test('hides Edit chart properties from a chart editor lacking chart write permis
   expect(screen.queryByText('Edit chart properties')).not.toBeInTheDocument();
 });
 
-test('escapeCsvValue neutralizes spreadsheet formula prefixes', () => {
-  // Mirrors superset/utils/csv.py escape_value so the client-built
-  // "Current View" CSV cannot ship live formulas (CSV injection).
-  expect(escapeCsvValue('=HYPERLINK("https://attacker.example")')).toBe(
-    `"'=HYPERLINK(""https://attacker.example"")"`,
-  );
-  expect(escapeCsvValue('@SUM(1+1)')).toBe(`'@SUM(1+1)`);
-  expect(escapeCsvValue('+cmd')).toBe(`'+cmd`);
-  expect(escapeCsvValue('%x')).toBe(`'%x`);
-  expect(escapeCsvValue('\t=1+1')).toBe(`'\t=1+1`);
-  expect(escapeCsvValue('  =1+1')).toBe(`'  =1+1`);
-  expect(escapeCsvValue('=cmd|calc')).toBe(`'=cmd\\|calc`);
-});
-
-test('escapeCsvValue escapes pre-existing backslashes before escaping pipes', () => {
-  // A literal backslash sitting next to a pipe must not be left as-is: if it
-  // were, the escaped output (`\|`) would be indistinguishable from an
-  // escaped pipe, so a downstream unescaper couldn't recover the original
-  // value. Escaping backslashes first keeps the two cases unambiguous.
-  expect(escapeCsvValue('=cmd\\|calc')).toBe(`'=cmd\\\\\\|calc`);
-});
-
-test('escapeCsvValue RFC-4180-quotes a value containing a bare carriage return', () => {
-  // A raw \r inside a cell can be read as a record separator by some CSV
-  // consumers, so it must trigger outer quoting the same way \n does, even
-  // when it also triggered the formula-prefix guard above.
-  expect(escapeCsvValue('\r=1+1')).toBe(`"'\r=1+1"`);
-});
-
-test('escapeCsvValue keeps ordinary values intact', () => {
-  expect(escapeCsvValue('regular text')).toBe('regular text');
-  expect(escapeCsvValue('-12.5')).toBe('-12.5');
-  expect(escapeCsvValue(42)).toBe('42');
-  expect(escapeCsvValue(null)).toBe('');
-  expect(escapeCsvValue(undefined)).toBe('');
-  expect(escapeCsvValue('a,b')).toBe(`"a,b"`);
-  expect(escapeCsvValue('say "hi"')).toBe(`"say ""hi"""`);
-});
-
 test('shows 413 error toast when exportCSV fails with 413', async () => {
   mockExportChart.mockRejectedValue({ status: 413 });
 

superset-frontend/src/features/charts/ChartCard.tsx

@@ -96,11 +96,7 @@ export default function ChartCard({
   const canEdit = hasPerm('can_write');
   const canDelete = hasPerm('can_write');
   const canExport = hasPerm('can_export');
-  const allowEdit = isUserEditorOrAdmin(
-    user,
-    chart.editors,
-    chart.extra_editors,
-  );
+  const allowEdit = isUserEditorOrAdmin(user, chart.editors);
   const menuItems: MenuItem[] = [];
 
   if (canEdit) {

superset-frontend/src/features/dashboards/DashboardCard.tsx

@@ -83,11 +83,7 @@ function DashboardCard({
   const canEdit = hasPerm('can_write');
   const canDelete = hasPerm('can_write');
   const canExport = hasPerm('can_export');
-  const allowEdit = isUserEditorOrAdmin(
-    user,
-    dashboard.editors,
-    dashboard.extra_editors,
-  );
+  const allowEdit = isUserEditorOrAdmin(user, dashboard.editors);
   const digest = dashboard.changed_on_utc || dashboard.changed_on;
   const thumbnailUrl =
     isFeatureEnabled(FeatureFlag.Thumbnails) && dashboard.id && digest

superset-frontend/src/features/databases/DatabaseModal/index.test.tsx

@@ -136,7 +136,6 @@ describe('DatabaseModal', () => {
                 format: 'int32',
                 maximum: 65536,
                 minimum: 0,
-                nullable: true,
                 type: 'integer',
               },
               query: {
@@ -154,7 +153,7 @@ describe('DatabaseModal', () => {
                 type: 'string',
               },
             },
-            required: ['database', 'host', 'username'],
+            required: ['database', 'host', 'port', 'username'],
             type: 'object',
           },
           preferred: true,

superset-frontend/src/pages/ChartList/ChartList.test.tsx

@@ -383,223 +383,3 @@ describe('ChartList - Global Filter Interactions', () => {
     expect((searchInput as HTMLInputElement).value).toBe('');
   });
 });
-
-// The blocking-alerts/reports pre-flight in the Archive modal (sc-117151).
-// Each test registers its report-API route BEFORE setupMocks so it takes
-// precedence over the catch-all route.
-const adminChartUser = { ...mockUser, username: 'admin', permissions: {} };
-
-const openFirstDeleteModal = async () => {
-  // ALERT_REPORTS must be on for the pre-flight to fire at all — with it off
-  // the modal opens synchronously with no dependency fetch (see the flag-off
-  // test below).
-  (
-    isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-  ).mockImplementation(
-    (feature: string) =>
-      feature === 'SOFT_DELETE' || feature === 'ALERT_REPORTS',
-  );
-  renderChartList(adminChartUser);
-  await screen.findByTestId('chart-list-view');
-  const deleteButtons = await screen.findAllByTestId('chart-row-delete');
-  fireEvent.click(deleteButtons[0]);
-  return screen.findByRole('dialog');
-};
-
-test('archive modal lists the blocking alerts and reports with their types', async () => {
-  fetchMock.removeRoutes();
-  fetchMock.get('glob:*/api/v1/report/*', {
-    count: 2,
-    result: [
-      { id: 1, name: 'TC-081 rerun report', type: 'Report' },
-      { id: 2, name: 'Threshold alert', type: 'Alert' },
-    ],
-  });
-  setupMocks();
-  try {
-    const dialog = await openFirstDeleteModal();
-    expect(
-      within(dialog).getByText('Associated alerts and reports'),
-    ).toBeInTheDocument();
-    expect(within(dialog).getByText('TC-081 rerun report')).toBeInTheDocument();
-    expect(within(dialog).getByText('Threshold alert')).toBeInTheDocument();
-    expect(within(dialog).getByText('Report')).toBeInTheDocument();
-    expect(within(dialog).getByText('Alert')).toBeInTheDocument();
-    // Advisory only: the Archive button stays enabled.
-    expect(
-      within(dialog).getByRole('button', { name: 'Archive' }),
-    ).toBeEnabled();
-  } finally {
-    fetchMock.clearHistory();
-    (
-      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-    ).mockReset();
-  }
-});
-
-test('archive modal is unchanged when the chart has no alerts or reports', async () => {
-  fetchMock.removeRoutes();
-  fetchMock.get('glob:*/api/v1/report/*', { count: 0, result: [] });
-  setupMocks();
-  try {
-    const dialog = await openFirstDeleteModal();
-    expect(
-      within(dialog).getByText(/moved to Recently Archived/i),
-    ).toBeInTheDocument();
-    expect(
-      within(dialog).queryByText('Associated alerts and reports'),
-    ).not.toBeInTheDocument();
-  } finally {
-    fetchMock.clearHistory();
-    (
-      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-    ).mockReset();
-  }
-});
-
-test('archive modal opens unchanged and confirm still deletes when the report API 404s', async () => {
-  fetchMock.removeRoutes();
-  fetchMock.get('glob:*/api/v1/report/*', 404);
-  fetchMock.delete(`glob:*/api/v1/chart/${mockCharts[0].id}`, {});
-  setupMocks();
-  try {
-    const dialog = await openFirstDeleteModal();
-    expect(
-      within(dialog).queryByText('Associated alerts and reports'),
-    ).not.toBeInTheDocument();
-    fireEvent.click(within(dialog).getByRole('button', { name: 'Archive' }));
-    await waitFor(() =>
-      expect(
-        fetchMock.callHistory.calls(`glob:*/api/v1/chart/${mockCharts[0].id}`),
-      ).toHaveLength(1),
-    );
-  } finally {
-    fetchMock.clearHistory();
-    (
-      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-    ).mockReset();
-  }
-});
-
-test('archive modal caps the list at ten and reports the overflow count', async () => {
-  fetchMock.removeRoutes();
-  fetchMock.get('glob:*/api/v1/report/*', {
-    count: 12,
-    result: Array.from({ length: 10 }, (_, i) => ({
-      id: i + 1,
-      name: `Blocking report ${i + 1}`,
-      type: 'Report',
-    })),
-  });
-  setupMocks();
-  try {
-    const dialog = await openFirstDeleteModal();
-    expect(within(dialog).getByText('Blocking report 10')).toBeInTheDocument();
-    expect(within(dialog).getByText('... and 2 more')).toBeInTheDocument();
-  } finally {
-    fetchMock.clearHistory();
-    (
-      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-    ).mockReset();
-  }
-});
-
-test('archive modal refetches on every open so the list stays fresh', async () => {
-  fetchMock.removeRoutes();
-  fetchMock.get(
-    'glob:*/api/v1/report/*',
-    {
-      count: 1,
-      result: [{ id: 1, name: 'Detach me first', type: 'Report' }],
-    },
-    { name: 'blocking-reports' },
-  );
-  setupMocks();
-  try {
-    const dialog = await openFirstDeleteModal();
-    expect(within(dialog).getByText('Detach me first')).toBeInTheDocument();
-    fireEvent.click(within(dialog).getByRole('button', { name: 'Cancel' }));
-    await waitFor(() =>
-      expect(screen.queryByRole('dialog')).not.toBeInTheDocument(),
-    );
-
-    // The user detaches the report; the next open must show the new truth.
-    fetchMock.removeRoute('blocking-reports');
-    fetchMock.get(
-      'glob:*/api/v1/report/*',
-      { count: 0, result: [] },
-      { name: 'blocking-reports-empty' },
-    );
-    const deleteButtons = await screen.findAllByTestId('chart-row-delete');
-    fireEvent.click(deleteButtons[0]);
-    const reopened = await screen.findByRole('dialog');
-    expect(
-      within(reopened).queryByText('Detach me first'),
-    ).not.toBeInTheDocument();
-    expect(
-      within(reopened).queryByText('Associated alerts and reports'),
-    ).not.toBeInTheDocument();
-  } finally {
-    fetchMock.clearHistory();
-    (
-      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-    ).mockReset();
-  }
-});
-
-test('archive modal opens without any report fetch when ALERT_REPORTS is off', async () => {
-  fetchMock.removeRoutes();
-  fetchMock.get(
-    'glob:*/api/v1/report/*',
-    {
-      count: 1,
-      result: [{ id: 1, name: 'Should not appear', type: 'Report' }],
-    },
-    { name: 'reports-should-not-be-called' },
-  );
-  setupMocks();
-  (
-    isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-  ).mockImplementation((feature: string) => feature === 'SOFT_DELETE');
-  try {
-    renderChartList(adminChartUser);
-    await screen.findByTestId('chart-list-view');
-    const deleteButtons = await screen.findAllByTestId('chart-row-delete');
-    fireEvent.click(deleteButtons[0]);
-    const dialog = await screen.findByRole('dialog');
-    expect(
-      within(dialog).queryByText('Associated alerts and reports'),
-    ).not.toBeInTheDocument();
-    expect(
-      fetchMock.callHistory.calls('reports-should-not-be-called'),
-    ).toHaveLength(0);
-  } finally {
-    fetchMock.clearHistory();
-    (
-      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-    ).mockReset();
-  }
-});
-
-test('delete confirmation keeps the type-DELETE gate when SOFT_DELETE is off', async () => {
-  fetchMock.removeRoutes();
-  fetchMock.get('glob:*/api/v1/report/*', { count: 0, result: [] });
-  setupMocks();
-  (
-    isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-  ).mockImplementation((feature: string) => feature === 'ALERT_REPORTS');
-  try {
-    renderChartList(adminChartUser);
-    await screen.findByTestId('chart-list-view');
-    const deleteButtons = await screen.findAllByTestId('chart-row-delete');
-    fireEvent.click(deleteButtons[0]);
-    const dialog = await screen.findByRole('dialog');
-    expect(within(dialog).getByText('Please confirm')).toBeInTheDocument();
-    expect(screen.getByTestId('delete-modal-input')).toBeInTheDocument();
-  } finally {
-    fetchMock.clearHistory();
-    (
-      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
-    ).mockReset();
-  }
-});

superset-frontend/src/pages/ChartList/index.tsx

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { SupersetTheme, css, styled } from '@apache-superset/core/theme';
-import { t, tn } from '@apache-superset/core/translation';
+import { t } from '@apache-superset/core/translation';
 import {
   isFeatureEnabled,
   FeatureFlag,
@@ -26,7 +26,7 @@ import {
   SupersetClient,
   isMatrixifyEnabled,
 } from '@superset-ui/core';
-import { useState, useMemo, useCallback, useRef } from 'react';
+import { useState, useMemo, useCallback } from 'react';
 import rison from 'rison';
 import { uniqBy } from 'lodash-es';
 import { useSelector } from 'react-redux';
@@ -53,8 +53,6 @@ import {
   ActionButton,
   ConfirmStatusChange,
   CertifiedBadge,
-  DeleteModal,
-  List,
   Tooltip,
   FaveStar,
   InfoTooltip,
@@ -113,77 +111,6 @@ const FlexRowContainer = styled.div`
 `;
 
 const PAGE_SIZE = 25;
-// How many blocking alerts/reports the archive modal previews before the
-// "... and N more" overflow line (dataset-modal parity).
-const BLOCKING_REPORTS_PREVIEW_SIZE = 10;
-
-interface BlockingReport {
-  id: number;
-  name: string;
-  type: 'Alert' | 'Report';
-}
-
-interface ChartDeleteState {
-  chart: Chart;
-  blockingReports: BlockingReport[];
-  blockingReportsCount: number;
-}
-
-function ChartArchiveDescription({
-  chart,
-  blockingReports,
-  blockingReportsCount,
-  softDelete,
-}: ChartDeleteState & { softDelete: boolean }) {
-  const overflowCount = blockingReportsCount - blockingReports.length;
-  return (
-    <>
-      {softDelete ? (
-        <p>{archiveConfirmDescription(t('chart'))}</p>
-      ) : (
-        <p>
-          {t('Are you sure you want to delete')} <b>{chart.slice_name}</b>?
-        </p>
-      )}
-      {blockingReports.length > 0 && (
-        <>
-          <h4>{t('Associated alerts and reports')}</h4>
-          <p>
-            {t(
-              'Archiving or deleting this chart will be blocked while the following alerts or reports use it. Detach or delete them first.',
-            )}
-          </p>
-          <List
-            split={false}
-            size="small"
-            dataSource={blockingReports}
-            renderItem={(report: BlockingReport) => (
-              <List.Item key={report.id} compact>
-                <List.Item.Meta
-                  avatar={<span aria-hidden="true">•</span>}
-                  title={report.name}
-                  description={
-                    report.type === 'Alert' ? t('Alert') : t('Report')
-                  }
-                />
-              </List.Item>
-            )}
-          />
-          {overflowCount > 0 && (
-            <p>
-              {tn(
-                '... and %s more',
-                '... and %s more',
-                overflowCount,
-                overflowCount,
-              )}
-            </p>
-          )}
-        </>
-      )}
-    </>
-  );
-}
 const PASSWORDS_NEEDED_MESSAGE = t(
   'The passwords for the databases below are needed in order to ' +
     'import them together with the charts. Please note that the ' +
@@ -284,11 +211,6 @@ function ChartList(props: ChartListProps) {
   } = useChartEditModal(setCharts, charts);
 
   const [importingChart, showImportModal] = useState<boolean>(false);
-  const [chartCurrentlyDeleting, setChartCurrentlyDeleting] =
-    useState<ChartDeleteState | null>(null);
-  // Monotonic token: a late pre-flight response for an earlier click must not
-  // swap the modal to a different chart (last-response-wins race).
-  const deleteModalRequestRef = useRef(0);
   const [passwordFields, setPasswordFields] = useState<string[]>([]);
   const [preparingExport, setPreparingExport] = useState<boolean>(false);
   const [sshTunnelPasswordFields, setSSHTunnelPasswordFields] = useState<
@@ -352,51 +274,6 @@ function ChartList(props: ChartListProps) {
     [addDangerToast],
   );
 
-  const openChartDeleteModal = useCallback((chart: Chart) => {
-    deleteModalRequestRef.current += 1;
-    const requestToken = deleteModalRequestRef.current;
-    if (!isFeatureEnabled(FeatureFlag.AlertReports)) {
-      // The whole report API 404s when ALERT_REPORTS is off, while the delete
-      // guard still fires server-side. Skip the doomed request and open the
-      // unchanged modal immediately.
-      setChartCurrentlyDeleting({
-        chart,
-        blockingReports: [],
-        blockingReportsCount: 0,
-      });
-      return;
-    }
-    const queryParams = rison.encode({
-      filters: [{ col: 'chart_id', opr: 'eq', value: chart.id }],
-      columns: ['id', 'name', 'type'],
-      order_column: 'name',
-      order_direction: 'asc',
-      page_size: BLOCKING_REPORTS_PREVIEW_SIZE,
-    });
-    SupersetClient.get({ endpoint: `/api/v1/report/?q=${queryParams}` })
-      .then(({ json = {} }) => {
-        if (requestToken !== deleteModalRequestRef.current) return;
-        const blockingReports: BlockingReport[] = json.result ?? [];
-        setChartCurrentlyDeleting({
-          chart,
-          blockingReports,
-          blockingReportsCount: json.count ?? blockingReports.length,
-        });
-      })
-      .catch(() => {
-        if (requestToken !== deleteModalRequestRef.current) return;
-        // The report API can be visibility-filtered below what the delete
-        // guard sees, or fail outright. The list is advisory only, so every
-        // failure opens the unchanged modal rather than blocking the action;
-        // the confirm-time guard stays authoritative.
-        setChartCurrentlyDeleting({
-          chart,
-          blockingReports: [],
-          blockingReportsCount: 0,
-        });
-      });
-  }, []);
-
   function handleBulkChartDelete(chartsToDelete: Chart[]) {
     SupersetClient.delete({
       endpoint: `/api/v1/chart/?q=${rison.encode(
@@ -650,11 +527,14 @@ function ChartList(props: ChartListProps) {
       },
       {
         Cell: ({ row: { original } }: CellProps<Chart>) => {
-          const allowEdit = isUserEditorOrAdmin(
-            user,
-            original.editors,
-            original.extra_editors,
-          );
+          const allowEdit = isUserEditorOrAdmin(user, original.editors);
+          const handleDelete = () =>
+            handleChartDelete(
+              original,
+              addSuccessToast,
+              addDangerToast,
+              refreshData,
+            );
           const openEditModal = () => openChartEditModal(original);
           const handleExport = () => handleBulkChartExport([original]);
           if (!canEdit && !canDelete && !canExport) {
@@ -693,21 +573,43 @@ function ChartList(props: ChartListProps) {
                 />
               )}
               {canDelete && (
-                <ActionButton
-                  label={deleteActionLabel()}
-                  tooltip={
-                    allowEdit
-                      ? deleteActionLabel()
-                      : t(
-                          'You must be a chart editor in order to delete. Please reach out to a chart editor to request modifications or edit access.',
-                        )
+                <ConfirmStatusChange
+                  recoverable={softDelete}
+                  title={
+                    softDelete
+                      ? t('Archive %(name)s?', { name: original.slice_name })
+                      : t('Please confirm')
                   }
-                  placement="bottom"
-                  icon={<Icons.DeleteOutlined iconSize="l" />}
-                  dataTest="chart-row-delete"
-                  disabled={!allowEdit}
-                  onClick={() => openChartDeleteModal(original)}
-                />
+                  description={
+                    softDelete ? (
+                      archiveConfirmDescription(t('chart'))
+                    ) : (
+                      <>
+                        {t('Are you sure you want to delete')}{' '}
+                        <b>{original.slice_name}</b>?
+                      </>
+                    )
+                  }
+                  onConfirm={handleDelete}
+                >
+                  {confirmDelete => (
+                    <ActionButton
+                      label={deleteActionLabel()}
+                      tooltip={
+                        allowEdit
+                          ? deleteActionLabel()
+                          : t(
+                              'You must be a chart editor in order to delete. Please reach out to a chart editor to request modifications or edit access.',
+                            )
+                      }
+                      placement="bottom"
+                      icon={<Icons.DeleteOutlined iconSize="l" />}
+                      dataTest="chart-row-delete"
+                      disabled={!allowEdit}
+                      onClick={confirmDelete}
+                    />
+                  )}
+                </ConfirmStatusChange>
               )}
             </Actions>
           );
@@ -732,9 +634,11 @@ function ChartList(props: ChartListProps) {
       canExport,
       saveFavoriteStatus,
       favoriteStatus,
+      refreshData,
+      addSuccessToast,
+      addDangerToast,
       handleBulkChartExport,
       openChartEditModal,
-      openChartDeleteModal,
     ],
   );
 
@@ -1029,36 +933,6 @@ function ChartList(props: ChartListProps) {
           slice={sliceCurrentlyEditing}
         />
       )}
-      {chartCurrentlyDeleting && (
-        <DeleteModal
-          recoverable={softDelete}
-          title={
-            softDelete
-              ? t('Archive %(name)s?', {
-                  name: chartCurrentlyDeleting.chart.slice_name,
-                })
-              : t('Please confirm')
-          }
-          name={chartCurrentlyDeleting.chart.slice_name}
-          open
-          description={
-            <ChartArchiveDescription
-              {...chartCurrentlyDeleting}
-              softDelete={softDelete}
-            />
-          }
-          onConfirm={() => {
-            handleChartDelete(
-              chartCurrentlyDeleting.chart,
-              addSuccessToast,
-              addDangerToast,
-              refreshData,
-            );
-            setChartCurrentlyDeleting(null);
-          }}
-          onHide={() => setChartCurrentlyDeleting(null)}
-        />
-      )}
       <ConfirmStatusChange
         recoverable={softDelete}
         title={softDelete ? t('Archive selected charts?') : t('Please confirm')}

superset-frontend/src/pages/DashboardList/index.tsx

@@ -122,8 +122,6 @@ export interface Dashboard {
   description?: string;
   thumbnail_url?: string | null;
   editors?: Subject[];
-  // Bare subject ids from a deployment's EXTRA_EDITORS_RESOLVER.
-  extra_editors?: number[];
   viewers?: Subject[];
   tags: TagType[];
   created_by: object;
@@ -507,11 +505,7 @@ function DashboardList(props: DashboardListProps) {
       },
       {
         Cell: ({ row: { original } }: CellProps<Dashboard>) => {
-          const allowEdit = isUserEditorOrAdmin(
-            user,
-            original.editors,
-            original.extra_editors,
-          );
+          const allowEdit = isUserEditorOrAdmin(user, original.editors);
           const handleDelete = () =>
             handleDashboardDelete(
               original,

superset-frontend/src/pages/SqlLab/LocationContext.test.tsx

@@ -1,66 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { MemoryRouter } from 'react-router-dom';
-import { render, screen } from 'spec/helpers/testing-library';
-
-import { LocationProvider, useLocationState } from './LocationContext';
-
-const Probe = () => {
-  const { requestedQuery } = useLocationState();
-  return (
-    <>
-      <span data-test="autorun">{String(requestedQuery?.autorun)}</span>
-      <span data-test="sql">{String(requestedQuery?.sql)}</span>
-    </>
-  );
-};
-
-const setup = (initialEntry: string | { pathname: string; state: object }) =>
-  render(
-    <MemoryRouter initialEntries={[initialEntry]}>
-      <LocationProvider>
-        <Probe />
-      </LocationProvider>
-    </MemoryRouter>,
-  );
-
-test('never derives autorun from the URL querystring', () => {
-  // Regression test: a crafted cross-site GET link must not be able to
-  // auto-execute SQL in the victim's session (top-level navigation sends
-  // SameSite=Lax session cookies).
-  setup('/sqllab?dbid=1&sql=SELECT%20%2A%20FROM%20t&autorun=true');
-  expect(screen.getByTestId('autorun')).toHaveTextContent('false');
-  // The deep link still prefills the editor with the requested SQL.
-  expect(screen.getByTestId('sql')).toHaveTextContent('SELECT * FROM t');
-});
-
-test('querystring autorun stays false even when spread from raw params', () => {
-  // `...Object.fromEntries(queryParams)` must not reintroduce the raw
-  // `autorun` string value.
-  setup('/sqllab?sql=SELECT%201&autorun=true');
-  expect(screen.getByTestId('autorun')).toHaveTextContent('false');
-});
-
-test('honors autorun from in-app location.state navigations', () => {
-  setup({
-    pathname: '/sqllab',
-    state: { requestedQuery: { sql: 'SELECT 1', autorun: true } },
-  });
-  expect(screen.getByTestId('autorun')).toHaveTextContent('true');
-});

superset-frontend/src/pages/SqlLab/LocationContext.tsx

@@ -41,14 +41,12 @@ export const LocationProvider: FC<{ children?: ReactNode }> = ({
   const queryParams = new URLSearchParams(location.search);
   const permalink = location.pathname.match(/\/p\/\w+/)?.[0].slice(3);
   if (queryParams.size > 0 || permalink) {
-    // Deep links (querystring or permalink) prefill the editor and wait
-    // for the user to press Run. Only in-app navigations that pass
-    // `location.state` (handled above) may request autorun.
+    const autorun = queryParams.get('autorun') === 'true';
     const isDataset = queryParams.get('isDataset') === 'true';
     const queryParamsState = {
       requestedQuery: {
         ...Object.fromEntries(queryParams),
-        autorun: false,
+        autorun,
         permalink,
       },
       isDataset,

superset-frontend/src/types/Chart.ts

@@ -45,8 +45,6 @@ export interface Chart {
   cache_timeout: number | null;
   thumbnail_url?: string;
   editors?: Subject[];
-  // Bare subject ids from a deployment's EXTRA_EDITORS_RESOLVER.
-  extra_editors?: number[];
   viewers?: Subject[];
   tags?: TagType[];
   last_saved_at?: string;

superset-frontend/src/views/CRUD/types.ts

@@ -67,8 +67,6 @@ export interface Dashboard {
   url: string;
   thumbnail_url?: string | null;
   editors?: Subject[];
-  // Bare subject ids from a deployment's EXTRA_EDITORS_RESOLVER.
-  extra_editors?: number[];
   viewers?: Subject[];
   loading?: boolean;
 }

superset-frontend/src/views/CRUD/utils.test.tsx

@@ -17,12 +17,8 @@
  * under the License.
  */
 import rison from 'rison';
-import { waitFor } from '@testing-library/react';
-import { SupersetClient } from '@superset-ui/core';
-import Chart from 'src/types/Chart';
 import {
   checkUploadExtensions,
-  handleChartDelete,
   getAlreadyExists,
   getEncryptedExtraFieldsNeeded,
   getFilterValues,
@@ -747,27 +743,3 @@ test('getFilterValues', () => {
     );
   });
 });
-
-test('handleChartDelete surfaces the blocking alert/report names from a 422', async () => {
-  const guardMessage =
-    'There are associated alerts or reports: TC-081 rerun report';
-  const deleteSpy = jest
-    .spyOn(SupersetClient, 'delete')
-    .mockRejectedValue(
-      new Response(JSON.stringify({ message: guardMessage }), { status: 422 }),
-    );
-  const addDangerToast = jest.fn();
-  try {
-    handleChartDelete(
-      { id: 1, slice_name: 'blocked chart' } as Chart,
-      jest.fn(),
-      addDangerToast,
-      jest.fn(),
-    );
-    await waitFor(() => expect(addDangerToast).toHaveBeenCalledTimes(1));
-    expect(addDangerToast.mock.calls[0][0]).toContain('TC-081 rerun report');
-    expect(addDangerToast.mock.calls[0][0]).toContain('blocked chart');
-  } finally {
-    deleteSpy.mockRestore();
-  }
-});

superset-frontend/src/views/CRUD/utils.tsx

@@ -379,9 +379,9 @@ export function handleChartDelete(
       else refreshData();
       addSuccessToast(deletedToast(sliceName));
     },
-    createErrorHandler(errMsg =>
-      addDangerToast(deleteFailedToast(sliceName, errMsg)),
-    ),
+    () => {
+      addDangerToast(deleteFailedToast(sliceName));
+    },
   );
 }
 

superset-frontend/src/visualizations/TimeTable/components/LeftCell/LeftCell.test.tsx

@@ -140,59 +140,4 @@ describe('LeftCell', () => {
       'http://example.com/sales?type=numeric&label=Sales Data',
     );
   });
-
-  test('should not render javascript: URLs as links for column rows', () => {
-    const columnRow = {
-      label: 'Test Column',
-      column_name: 'test_column',
-    };
-
-    render(
-      <LeftCell
-        row={columnRow}
-        rowType="column"
-        url="javascript:alert(document.domain)" // eslint-disable-line no-script-url
-      />,
-    );
-
-    expect(screen.queryByRole('link')).not.toBeInTheDocument();
-    expect(screen.getByText('Test Column')).toBeInTheDocument();
-  });
-
-  test('should not render script-bearing schemes assembled via templating', () => {
-    const columnRow = {
-      label: 'Test Column',
-      column_name: 'alert(1)',
-    };
-
-    render(
-      <LeftCell
-        row={columnRow}
-        rowType="column"
-        url="javascript:{{metric.column_name}}" // eslint-disable-line no-script-url
-      />,
-    );
-
-    expect(screen.queryByRole('link')).not.toBeInTheDocument();
-  });
-
-  test('should keep relative URLs as links', () => {
-    const columnRow = {
-      label: 'Test Column',
-      column_name: 'test_column',
-    };
-
-    render(
-      <LeftCell
-        row={columnRow}
-        rowType="column"
-        url="/superset/dashboard/{{metric.column_name}}/"
-      />,
-    );
-
-    expect(screen.getByRole('link')).toHaveAttribute(
-      'href',
-      '/superset/dashboard/test_column/',
-    );
-  });
 });

superset-frontend/src/visualizations/TimeTable/components/LeftCell/LeftCell.tsx

@@ -28,23 +28,6 @@ interface LeftCellProps {
   url?: string;
 }
 
-/**
- * Confines a caller-supplied URL to http(s) and relative schemes before
- * it's rendered as a link. Returns undefined for anything else, degrading
- * the cell to plain text.
- */
-export const toSafeHref = (url: string): string | undefined => {
-  try {
-    const { protocol } = new URL(url, window.location.origin);
-    if (protocol === 'http:' || protocol === 'https:') {
-      return url;
-    }
-  } catch {
-    // fall through: unparseable URLs are not rendered as links
-  }
-  return undefined;
-};
-
 /**
  * Renders the left cell containing either column labels or metric information
  */
@@ -52,7 +35,7 @@ const LeftCell = ({ row, rowType, url }: LeftCellProps): ReactElement => {
   const fullUrl = useMemo(() => {
     if (!url) return undefined;
     const context = { metric: row };
-    return toSafeHref(Mustache.render(url, context));
+    return Mustache.render(url, context);
   }, [url, row]);
 
   if (rowType === 'column') {

superset-websocket/spec/index.test.ts

@@ -625,42 +625,6 @@ describe('server', () => {
       );
       expect(wsEventMock).toHaveBeenCalledWith('pong', expect.any(Function));
     });
-
-    test('unsolicited pong payload cannot pollute Object.prototype', async () => {
-      const validToken = jwt.sign({ channel: channelId }, config.jwtSecret);
-      const request = getRequest(validToken, 'http://localhost');
-
-      server.wsConnection(ws, request);
-
-      // Extract the handler registered for the 'pong' event, the same way
-      // the underlying `ws` library would invoke it on a raw pong frame.
-      const pongCall = wsEventMock.mock.calls.find(call => call[0] === 'pong');
-      expect(pongCall).toBeDefined();
-      const pongHandler = pongCall![1] as (data: Buffer) => void;
-
-      // An unsolicited pong with a payload matching an inherited key must not
-      // resolve through the prototype chain and must not write through to
-      // Object.prototype.
-      pongHandler(Buffer.from('__proto__'));
-      pongHandler(Buffer.from('constructor'));
-      pongHandler(Buffer.from('hasOwnProperty'));
-
-      // eslint-disable-next-line no-prototype-builtins
-      expect(Object.prototype.hasOwnProperty('pongTs')).toBe(false);
-      expect(({} as Record<string, unknown>).pongTs).toBeUndefined();
-
-      // A genuine socket id must still record its pong normally.
-      const socketId = server.channels[channelId].sockets[0];
-      const beforePongTs = server.sockets[socketId].pongTs;
-      dateNowSpy.mockImplementation(() =>
-        new Date('2021-03-10T11:02:58.135Z').valueOf(),
-      );
-      pongHandler(Buffer.from(socketId));
-      expect(server.sockets[socketId].pongTs).not.toBe(beforePongTs);
-      expect(server.sockets[socketId].pongTs).toBe(
-        new Date('2021-03-10T11:02:58.135Z').valueOf(),
-      );
-    });
   });
 
   describe('connection limits', () => {

superset-websocket/src/index.ts

@@ -475,18 +475,12 @@ export const wsConnection = (ws: WebSocket, request: http.IncomingMessage) => {
   // init event handler for `pong` events (connection management)
   ws.on('pong', function pong(data: Buffer) {
     const socketId = data.toString();
-    // `sockets` is a plain object, so an unsolicited pong carrying an
-    // inherited key ('__proto__', 'constructor', 'hasOwnProperty', ...) as
-    // its payload would otherwise resolve through the prototype chain
-    // instead of missing outright, letting a client write an enumerable
-    // `pongTs` onto Object.prototype (tripped over by the for...in loops in
-    // checkSockets/cleanChannel on every GC pass). Guarding with an
-    // own-property check rejects every such key in one place.
-    if (!Object.prototype.hasOwnProperty.call(sockets, socketId)) {
+    const socketInstance = sockets[socketId];
+    if (!socketInstance) {
       logger.warn(`pong received for nonexistent socket ${socketId}`);
-      return;
+    } else {
+      socketInstance.pongTs = Date.now();
     }
-    sockets[socketId].pongTs = Date.now();
   });
 };
 

superset/charts/api.py

@@ -92,10 +92,7 @@ from superset.exceptions import (
 )
 from superset.extensions import event_logger, security_manager
 from superset.models.slice import Slice
-from superset.security.manager import (
-    get_extra_editor_subject_ids,
-    get_extra_editors_by_pk,
-)
+from superset.security.manager import get_extra_editor_subject_ids
 from superset.subjects.filters import (
     FilterRelatedSubjects,
     subject_type_filter,
@@ -413,15 +410,6 @@ class ChartRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
         except ChartNotFoundError:
             return self.response_404()
 
-    def pre_get_list(self, data: dict[str, Any]) -> None:
-        """Attach ``extra_editors`` to each row, matching the single-object GET."""
-        super().pre_get_list(data)
-        ids = data.get("ids", [])
-        extra_editors_by_id = get_extra_editors_by_pk(Slice, ids)
-        for row, row_id in zip(data.get("result", []), ids, strict=False):
-            if row_id in extra_editors_by_id:
-                row["extra_editors"] = extra_editors_by_id[row_id]
-
     @expose("/<pk>/deck_layers/", methods=("GET",))
     @protect()
     @safe
@@ -1062,7 +1050,7 @@ class ChartRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
                 task_status=cache_payload.get_status(),
             )
 
-        if cache_payload.should_trigger_task(force, expected_scope=f"chart:{chart.id}"):
+        if cache_payload.should_trigger_task(force):
             logger.info("Triggering screenshot ASYNC")
             screenshot_obj.cache.set(cache_key, ScreenshotCachePayload().to_dict())
             cache_chart_thumbnail.delay(
@@ -1124,12 +1112,6 @@ class ChartRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
             return self.response_404()
 
         if cache_payload := ChartScreenshot.get_from_cache_key(digest):
-            # The digest is caller-supplied and cache entries are shared
-            # across every chart (and, via the same backend, dashboards) --
-            # without this check any cache_key learned for one chart would
-            # serve its image under a different, merely-accessible `pk`.
-            if cache_payload.get_scope() != f"chart:{chart.id}":
-                return self.response_404()
             if cache_payload.status == StatusValues.UPDATED:
                 try:
                     image = cache_payload.get_image()

superset/commands/chart/delete.py

@@ -15,7 +15,6 @@
 # specific language governing permissions and limitations
 # under the License.
 import logging
-from collections import defaultdict
 from functools import partial
 from typing import Optional
 
@@ -33,62 +32,11 @@ from superset.daos.chart import ChartDAO
 from superset.daos.report import ReportScheduleDAO
 from superset.exceptions import SupersetSecurityException
 from superset.models.slice import Slice
-from superset.reports.models import ReportSchedule
 from superset.utils.decorators import on_error, transaction
 
 logger = logging.getLogger(__name__)
 
 
-def build_blocked_by_reports_message(
-    charts: list[Slice],
-    reports: list[ReportSchedule],
-    single_target: bool,
-) -> str:
-    """Build the user-facing message naming the alerts/reports that block deletion.
-
-    Groups the blocking reports per chart, sorted by chart name (chart id as
-    the tie-breaker) and then report name so the message is deterministic
-    across database backends, and appends the remedy sentence. When the
-    command targets a single chart id the group prefix is dropped — in the
-    single-delete endpoint the surrounding toast already names the chart, and
-    in a one-chart bulk selection the user's own selection provides the
-    context. A multi-id command keeps the prefix on every group because the
-    bulk toast is generic, so the prefix is the only chart identification the
-    user gets.
-    """
-    sentences: list[str] = []
-    if single_target:
-        names = sorted(report.name for report in reports)
-        sentences.append(
-            str(
-                _(
-                    "This chart is used by alerts or reports: %(names)s.",
-                    names=", ".join(names),
-                )
-            )
-        )
-    else:
-        report_names_by_chart_id: dict[int, list[str]] = defaultdict(list)
-        for report in reports:
-            report_names_by_chart_id[report.chart_id].append(report.name)
-        charts_by_id = {chart.id: chart for chart in charts}
-        for chart_id, names in sorted(
-            report_names_by_chart_id.items(),
-            key=lambda item: (charts_by_id[item[0]].slice_name or "", item[0]),
-        ):
-            sentences.append(
-                str(
-                    _(
-                        'Chart "%(chart)s" is used by alerts or reports: %(names)s.',
-                        chart=charts_by_id[chart_id].slice_name or str(chart_id),
-                        names=", ".join(sorted(names)),
-                    )
-                )
-            )
-    sentences.append(str(_("Detach or delete them first.")))
-    return " ".join(sentences)
-
-
 class DeleteChartCommand(BaseCommand):
     def __init__(self, model_ids: list[int]):
         self._model_ids = model_ids
@@ -107,11 +55,11 @@ class DeleteChartCommand(BaseCommand):
             raise ChartNotFoundError()
         # Check there are no associated ReportSchedules
         if reports := ReportScheduleDAO.find_by_chart_ids(self._model_ids):
+            report_names = [report.name for report in reports]
             raise ChartDeleteFailedReportsExistError(
-                build_blocked_by_reports_message(
-                    self._models,
-                    reports,
-                    single_target=len(self._model_ids) == 1,
+                _(
+                    "There are associated alerts or reports: %(report_names)s",
+                    report_names=",".join(report_names),
                 )
             )
         # Check editorship

superset/commands/dashboard/importers/dispatcher.py

@@ -21,21 +21,17 @@ from typing import Any
 from marshmallow.exceptions import ValidationError
 
 from superset.commands.base import BaseCommand
-from superset.commands.dashboard.importers import v1
+from superset.commands.dashboard.importers import v0, v1
 from superset.commands.exceptions import CommandInvalidError
 from superset.commands.importers.exceptions import IncorrectVersionError
 
 logger = logging.getLogger(__name__)
 
-# list of different import formats supported. The legacy v0 importer is
-# deliberately NOT dispatched here: it overrides datasets matched by
-# (table_name, schema, database) and charts/dashboards matched by remote_id
-# without ownership checks, and this dispatcher is reachable from the HTTP
-# import endpoint (POST /api/v1/dashboard/import/). Operators can still
-# import legacy v0 JSON files with the `legacy_import_dashboards` CLI
-# command, which uses the v0 command directly.
+# list of different import formats supported; v0 should be last because
+# the files are not versioned
 command_versions = [
     v1.ImportDashboardsCommand,
+    v0.ImportDashboardsCommand,
 ]
 
 

superset/commands/database/importers/v1/utils.py

@@ -21,10 +21,8 @@ from typing import Any
 from flask import current_app as app
 
 from superset import db, security_manager
-from superset.commands.database.exceptions import DatabaseInvalidError
 from superset.commands.database.utils import add_permissions
 from superset.commands.exceptions import ImportFailedError
-from superset.constants import PASSWORD_MASK
 from superset.databases.ssh_tunnel.models import SSHTunnel
 from superset.databases.utils import make_url_safe
 from superset.db_engine_specs.exceptions import SupersetDBAPIConnectionError
@@ -39,73 +37,6 @@ from superset.utils import json
 logger = logging.getLogger(__name__)
 
 
-def _connection_identity_changed(existing: Database, config: dict[str, Any]) -> bool:
-    """Whether the import points the database at a different endpoint."""
-    try:
-        stored = make_url_safe(existing.sqlalchemy_uri)._replace(password=None)
-        incoming = make_url_safe(config["sqlalchemy_uri"])._replace(password=None)
-    except DatabaseInvalidError:
-        # An unparseable URI cannot be compared: treat it as a change so
-        # stored secrets never survive onto it.
-        return True
-    return stored != incoming
-
-
-def _refuse_stored_secret_reuse(existing: Database, config: dict[str, Any]) -> None:
-    """
-    Refuse an overwrite that changes the connection endpoint without fresh
-    credentials.
-
-    Database UUIDs are not secrets -- they appear in every exported bundle --
-    so an import must not be able to repoint an existing connection at a new
-    host while the stored password (or SSH tunnel key) is silently kept: the
-    next connection would hand the real credential to the new endpoint.
-    """
-    if _connection_identity_changed(existing, config):
-        try:
-            uri_password = make_url_safe(config["sqlalchemy_uri"]).password
-        except DatabaseInvalidError:
-            uri_password = None
-        if config.get("password") in (None, PASSWORD_MASK) and uri_password in (
-            None,
-            PASSWORD_MASK,
-        ):
-            raise ImportFailedError(
-                f"Import would change the connection of database "
-                f"'{existing.database_name}' without providing new "
-                "credentials. Re-enter the database password for the new "
-                "connection to confirm the change."
-            )
-
-    if ssh_tunnel := config.get("ssh_tunnel"):
-        existing_tunnel = existing.ssh_tunnel
-        if existing_tunnel and (
-            ssh_tunnel.get("server_address") != existing_tunnel.server_address
-            or ssh_tunnel.get("server_port") != existing_tunnel.server_port
-        ):
-            has_fresh_credential = any(
-                ssh_tunnel.get(field) not in (None, PASSWORD_MASK)
-                for field in ("password", "private_key")
-            )
-            # A passphrase-protected private key's stored passphrase is a
-            # secret in its own right: if the existing tunnel had one, a
-            # repoint that supplies a fresh private_key but leaves
-            # private_key_password masked/absent would keep the old
-            # passphrase attached to the new key rather than requiring the
-            # importer to confirm it too.
-            stale_private_key_password = (
-                existing_tunnel.private_key_password is not None
-                and ssh_tunnel.get("private_key_password") in (None, PASSWORD_MASK)
-            )
-            if not has_fresh_credential or stale_private_key_password:
-                raise ImportFailedError(
-                    f"Import would change the SSH tunnel endpoint of database "
-                    f"'{existing.database_name}' without providing new tunnel "
-                    "credentials. Re-enter the SSH tunnel credentials to "
-                    "confirm the change."
-                )
-
-
 def import_database(  # noqa: C901
     config: dict[str, Any],
     overwrite: bool = False,
@@ -120,11 +51,6 @@ def import_database(  # noqa: C901
         if not overwrite or not can_write:
             return existing
         config["id"] = existing.id
-        # Stored secrets must not be rebound to a different endpoint: without
-        # fresh credentials, an overwrite that changes where the database (or
-        # its SSH tunnel) connects would exfiltrate the stored secret to the
-        # new endpoint on the next connection.
-        _refuse_stored_secret_reuse(existing, config)
     elif not can_write:
         raise ImportFailedError(
             "Database doesn't exist and user doesn't have permission to create databases"  # noqa: E501
@@ -155,13 +81,7 @@ def import_database(  # noqa: C901
     # For existing DBs, reveal masked sensitive values from current encrypted_extra.
     # For new DBs, schema validation already ensured no fields are still masked.
     if masked_encrypted_extra := config.pop("masked_encrypted_extra", None):
-        # Never reveal stored encrypted_extra secrets into a config that
-        # repoints the connection at a different endpoint.
-        if (
-            existing
-            and existing.encrypted_extra
-            and not _connection_identity_changed(existing, config)
-        ):
+        if existing and existing.encrypted_extra:
             old_config = json.loads(existing.encrypted_extra)
             new_config = json.loads(masked_encrypted_extra)
             sensitive_fields = (

superset/commands/dataset/importers/dispatcher.py

@@ -21,21 +21,17 @@ from typing import Any
 from marshmallow.exceptions import ValidationError
 
 from superset.commands.base import BaseCommand
-from superset.commands.dataset.importers import v1
+from superset.commands.dataset.importers import v0, v1
 from superset.commands.exceptions import CommandInvalidError
 from superset.commands.importers.exceptions import IncorrectVersionError
 
 logger = logging.getLogger(__name__)
 
-# list of different import formats supported. The legacy v0 importer is
-# deliberately NOT dispatched here: it overrides datasets matched by
-# (table_name, schema, database) without ownership checks, and this
-# dispatcher is reachable from the HTTP import endpoint
-# (POST /api/v1/dataset/import/). Operators can still import legacy v0
-# YAML files with the `legacy_import_datasources` CLI command, which uses
-# the v0 command directly.
+# list of different import formats supported; v0 should be last because
+# the files are not versioned
 command_versions = [
     v1.ImportDatasetsCommand,
+    v0.ImportDatasetsCommand,
 ]
 
 

superset/commands/dataset/importers/v1/utils.py

@@ -15,7 +15,6 @@
 # specific language governing permissions and limitations
 # under the License.
 import gzip
-import io
 import ipaddress
 import logging
 import os
@@ -612,29 +611,6 @@ def _convert_temporal_columns(df: pd.DataFrame, dtype: dict[str, Any]) -> None:
                 df[column_name] = converted
 
 
-def _read_bounded(stream: Any, max_bytes: int) -> io.BytesIO:
-    """
-    Read ``stream`` into memory, failing once more than ``max_bytes`` bytes
-    have been produced.
-
-    Bounds both the raw download and gzip decompression amplification for
-    dataset data URIs: the ``.gz`` path had no analogue of
-    ``check_is_safe_zip`` and allowed unbounded expansion from a small
-    payload.
-    """
-    buffer = io.BytesIO()
-    while chunk := stream.read(1024 * 1024):
-        # Both http.client responses and gzip.open() yield bytes; a handful
-        # of tests substitute a text stream, so normalize either shape.
-        if isinstance(chunk, str):
-            chunk = chunk.encode("utf-8")
-        buffer.write(chunk)
-        if buffer.tell() > max_bytes:
-            raise ImportFailedError("Data URI payload exceeds the maximum allowed size")
-    buffer.seek(0)
-    return buffer
-
-
 def load_data(data_uri: str, dataset: SqlaTable, database: Database) -> None:
     """
     Load data from a data URI into a dataset.
@@ -661,15 +637,9 @@ def load_data(data_uri: str, dataset: SqlaTable, database: Database) -> None:
         handlers.extend([_PeerValidatingHTTPHandler, _PeerValidatingHTTPSHandler])
     opener = request.build_opener(*handlers)
     data = opener.open(data_uri)  # pylint: disable=consider-using-with  # noqa: S310
-    # Cap the bytes materialized from the download, before and after gzip
-    # decompression (same per-file knob as ZIP bundle uploads): a gzip
-    # stream can carry oversized headers, trailing data, or additional
-    # members that would otherwise let the raw (compressed) download exceed
-    # the limit even when the decompressed CSV stays within it.
-    max_bytes = app.config["ZIPPED_FILE_MAX_SIZE"]
     if data_uri.endswith(".gz"):
-        data = gzip.open(_read_bounded(data, max_bytes))
-    df = pd.read_csv(_read_bounded(data, max_bytes), encoding="utf-8")
+        data = gzip.open(data)
+    df = pd.read_csv(data, encoding="utf-8")
     dtype = get_dtype(df, dataset)
 
     _convert_temporal_columns(df, dtype)

superset/commands/importers/v1/utils.py

@@ -27,7 +27,6 @@ from sqlalchemy.orm import Session
 from superset import db
 from superset.commands.importers.exceptions import IncorrectVersionError
 from superset.databases.ssh_tunnel.models import SSHTunnel
-from superset.databases.utils import make_url_safe
 from superset.extensions import feature_flag_manager
 from superset.models.core import Database
 from superset.models.dashboard import dashboard_slices
@@ -104,34 +103,6 @@ def validate_metadata_type(
             exceptions.append(exc)
 
 
-def database_connection_identity_unchanged(
-    stored_uri: Optional[str], incoming_uri: Optional[str]
-) -> bool:
-    """
-    Whether an incoming database config still points at the same connection
-    (driver, host, port -- everything except the credential) as the stored one.
-
-    Stored secrets may only be re-attached to an import when this holds:
-    database UUIDs are not secrets (they appear in every exported bundle and
-    in API responses), so re-attaching secrets on a UUID match alone would
-    let a hostile bundle repoint an existing connection at an
-    attacker-controlled server that then receives the victim's real
-    credentials.
-    """
-    if not stored_uri or not incoming_uri:
-        return False
-    try:
-        stored = make_url_safe(stored_uri)._replace(password=None)
-        incoming = make_url_safe(incoming_uri)._replace(password=None)
-    except Exception:  # pylint: disable=broad-except
-        # An unparseable URI cannot be compared; never attach secrets to it.
-        return False
-    # Compare the full URL minus the credential, not just host/port: query
-    # arguments become driver connect args and can themselves redirect the
-    # connection (e.g. ``?host=`` for postgres drivers).
-    return stored == incoming
-
-
 # pylint: disable=too-many-locals,too-many-arguments
 # ruff: noqa: C901
 def load_configs(
@@ -170,21 +141,6 @@ def load_configs(
             SSHTunnel.uuid, SSHTunnel.private_key_password
         ).all()
     }
-    # load connection endpoints so stored secrets are only re-attached to a
-    # config that still points at the same endpoint (see
-    # database_connection_identity_unchanged)
-    db_sqlalchemy_uris: dict[str, str] = {
-        str(uuid): sqlalchemy_uri
-        for uuid, sqlalchemy_uri in db.session.query(
-            Database.uuid, Database.sqlalchemy_uri
-        ).all()
-    }
-    db_ssh_tunnel_servers: dict[str, tuple[Any, Any]] = {
-        str(uuid): (server_address, server_port)
-        for uuid, server_address, server_port in db.session.query(
-            SSHTunnel.uuid, SSHTunnel.server_address, SSHTunnel.server_port
-        ).all()
-    }
     for file_name, content in contents.items():
         # skip directories
         if not content:
@@ -195,38 +151,6 @@ def load_configs(
         if schema:
             try:
                 config = load_yaml(file_name, content)
-                if not isinstance(config, dict):
-                    # A syntactically valid YAML document whose top-level
-                    # value is a scalar or list (not a mapping) has no
-                    # fields to validate against the schema; report it the
-                    # same way as unparseable YAML instead of letting the
-                    # ``.get()`` calls below raise an unhandled AttributeError.
-                    raise ValidationError({file_name: "Not a valid YAML file"})
-
-                # Stored secrets are only reusable when the incoming config
-                # still points at the same endpoint as the stored one; a UUID
-                # match alone must never rebind stored credentials to a new
-                # host (see database_connection_identity_unchanged).
-                db_secrets_reusable = (
-                    prefix == "databases"
-                    and database_connection_identity_unchanged(
-                        db_sqlalchemy_uris.get(str(config.get("uuid"))),
-                        config.get("sqlalchemy_uri"),
-                    )
-                )
-                incoming_tunnel = config.get("ssh_tunnel") or {}
-                stored_tunnel_server = db_ssh_tunnel_servers.get(
-                    str(config.get("uuid"))
-                )
-                tunnel_secrets_reusable = (
-                    prefix == "databases"
-                    and stored_tunnel_server is not None
-                    and (
-                        incoming_tunnel.get("server_address"),
-                        incoming_tunnel.get("server_port"),
-                    )
-                    == stored_tunnel_server
-                )
 
                 # populate passwords from the request, from YAML config,
                 # or from existing DBs
@@ -235,15 +159,14 @@ def load_configs(
                 elif prefix == "databases" and config.get("password"):
                     # password already in YAML config, keep it
                     pass
-                elif db_secrets_reusable and config["uuid"] in db_passwords:
+                elif prefix == "databases" and config["uuid"] in db_passwords:
                     config["password"] = db_passwords[config["uuid"]]
 
                 # populate ssh_tunnel_passwords from the request or from existing DBs
                 if file_name in ssh_tunnel_passwords:
                     config["ssh_tunnel"]["password"] = ssh_tunnel_passwords[file_name]
                 elif (
-                    tunnel_secrets_reusable
-                    and config["uuid"] in db_ssh_tunnel_passwords
+                    prefix == "databases" and config["uuid"] in db_ssh_tunnel_passwords
                 ):
                     config["ssh_tunnel"]["password"] = db_ssh_tunnel_passwords[
                         config["uuid"]
@@ -255,7 +178,7 @@ def load_configs(
                         file_name
                     ]
                 elif (
-                    tunnel_secrets_reusable
+                    prefix == "databases"
                     and config["uuid"] in db_ssh_tunnel_private_keys
                 ):
                     config["ssh_tunnel"]["private_key"] = db_ssh_tunnel_private_keys[
@@ -268,7 +191,7 @@ def load_configs(
                         ssh_tunnel_priv_key_passwords[file_name]
                     )
                 elif (
-                    tunnel_secrets_reusable
+                    prefix == "databases"
                     and config["uuid"] in db_ssh_tunnel_priv_key_passws
                 ):
                     config["ssh_tunnel"]["private_key_password"] = (

superset/commands/query/importers/v1/utils.py

@@ -17,52 +17,16 @@
 
 from typing import Any
 
-from superset import db, security_manager
-from superset.commands.exceptions import ImportFailedError
+from superset import db
 from superset.models.sql_lab import SavedQuery
-from superset.utils.core import get_user
 
 
-def import_saved_query(
-    config: dict[str, Any],
-    overwrite: bool = False,
-    ignore_permissions: bool = False,
-) -> SavedQuery:
-    """Import a saved query from a config dict, handling existing matches.
-
-    A saved query is a personal, per-user asset: the REST API scopes read,
-    update and delete to ``created_by == g.user`` (``SavedQueryFilter``).
-    The same object-level rule is enforced here on the overwrite path so an
-    importer cannot replace another user's saved query (and the SQL the
-    victim will later run under their own grants) by reusing its UUID in an
-    import bundle -- matching the permission checks every sibling importer
-    (chart, dashboard, dataset, database, theme) already performs.
-    """
-    can_write = ignore_permissions or security_manager.can_access(
-        "can_write",
-        "SavedQuery",
-    )
+def import_saved_query(config: dict[str, Any], overwrite: bool = False) -> SavedQuery:
     existing = db.session.query(SavedQuery).filter_by(uuid=config["uuid"]).first()
     if existing:
-        if not overwrite or not can_write:
+        if not overwrite:
             return existing
-        # ``user`` is None on background paths (no Flask request user);
-        # combined with ``can_write`` (typically from
-        # ``ignore_permissions=True``) the ownership check is skipped there
-        # because the caller has already established trust -- mirroring the
-        # chart importer.
-        user = get_user()
-        if user and not (security_manager.is_admin() or existing.created_by == user):
-            raise ImportFailedError(
-                f"Saved query (uuid {config['uuid']}) already exists and "
-                "user doesn't have permissions to overwrite it"
-            )
         config["id"] = existing.id
-    elif not can_write:
-        raise ImportFailedError(
-            "Saved query doesn't exist and user doesn't have permission to "
-            "create saved queries"
-        )
 
     saved_query = SavedQuery.import_from_dict(config, recursive=False)
     if saved_query.id is None:

superset/commands/report/create.py

@@ -154,7 +154,7 @@ class CreateReportScheduleCommand(CreateMixin, BaseReportScheduleCommand):
         if (
             creation_method != ReportCreationMethod.ALERTS_REPORTS
             and not ReportScheduleDAO.validate_unique_creation_method(
-                dashboard_id, chart_id, creation_method
+                dashboard_id, chart_id
             )
         ):
             raise ReportScheduleCreationMethodUniquenessValidationError()

superset/commands/sql_lab/execute.py

@@ -151,15 +151,6 @@ class ExecuteSqlCommand(BaseCommand):
             self._validate_access(query, self._execution_context.template_params)
             self._execution_context.set_query(query)
             rendered_query = self._sql_query_render.render(self._execution_context)
-            # The check above authorizes a render of query.sql + template_params
-            # performed before rendering, so that macros with side effects are
-            # gated before they run. self._sql_query_render.render() above is an
-            # independent second render of the same source; for a
-            # nondeterministic template (e.g. one using Jinja's `random` filter
-            # to pick a table) the two renders can diverge, letting a query
-            # read a table the first check never saw. Re-validate the literal
-            # rendered text that is about to execute.
-            self._validate_rendered_access(query, rendered_query)
             self._set_query_limit_if_required(rendered_query)
             self._query_dao.update(
                 query, {"limit": self._execution_context.query.limit}
@@ -221,23 +212,6 @@ class ExecuteSqlCommand(BaseCommand):
         except Exception as ex:
             raise QueryIsForbiddenToAccessException(self._execution_context, ex) from ex
 
-    def _validate_rendered_access(self, query: Query, rendered_query: str) -> None:
-        """
-        Re-authorize the exact SQL that is about to execute.
-
-        Pins ``query.executed_sql`` to the literal, already-rendered text so
-        ``security_manager.raise_for_access``'s "prefer executed_sql" path
-        authorizes that exact SQL directly, with no further Jinja
-        re-render (see its docstring). ``executed_sql`` is reset
-        afterwards so the execution path can assign its own final
-        (limited / per-block mutated) SQL.
-        """
-        query.executed_sql = rendered_query
-        try:
-            self._validate_access(query, self._execution_context.template_params)
-        finally:
-            query.executed_sql = None
-
     def _set_query_limit_if_required(
         self,
         rendered_query: str,

superset/commands/sql_lab/permalink/get.py

@@ -17,6 +17,7 @@
 import logging
 from typing import Optional
 
+from superset import db
 from superset.commands.dataset.exceptions import DatasetNotFoundError
 from superset.commands.sql_lab.permalink.base import BaseSqlLabPermalinkCommand
 from superset.daos.key_value import KeyValueDAO
@@ -26,8 +27,10 @@ from superset.key_value.exceptions import (
     KeyValueParseKeyError,
 )
 from superset.key_value.utils import decode_permalink_id
+from superset.models import core as models
 from superset.sqllab.permalink.exceptions import SqlLabPermalinkGetFailedError
 from superset.sqllab.permalink.types import SqlLabPermalinkValue
+from superset.utils import core as utils, json
 
 logger = logging.getLogger(__name__)
 
@@ -38,14 +41,18 @@ class GetSqlLabPermalinkCommand(BaseSqlLabPermalinkCommand):
 
     def run(self) -> Optional[SqlLabPermalinkValue]:
         self.validate()
-        # Legacy `kv:<int>` keys (from the pre-permalink `keyvalue` table) are
-        # no longer resolved here: that table has sequential integer primary
-        # keys and no owner column, so any authenticated caller could
-        # enumerate other users' saved editor state (SQL text and
-        # connection/schema context) by incrementing the id. Such keys now
-        # fall through to `decode_permalink_id` below, which rejects them
-        # (they don't decode against the salted hashid scheme), leaving the
-        # modern salted-hashid store as the only way to resolve a permalink.
+        if self.key.startswith("kv:"):
+            id = int(self.key[3:])
+            try:
+                kv = db.session.query(models.KeyValue).filter_by(id=id).scalar()
+                if not kv:
+                    return None
+                return json.loads(kv.value)
+            except Exception as ex:
+                raise SqlLabPermalinkGetFailedError(
+                    message=utils.error_msg_from_exception(ex)
+                ) from ex
+
         try:
             key = decode_permalink_id(self.key, salt=self.salt)
             value = KeyValueDAO.get_value(self.resource, key, self.codec)

superset/commands/streaming_export/base.py

@@ -33,7 +33,6 @@ from sqlalchemy import text
 
 from superset import db
 from superset.commands.base import BaseCommand
-from superset.utils.csv import escape_value
 
 logger = logging.getLogger(__name__)
 
@@ -111,15 +110,7 @@ class BaseStreamingCSVExportCommand(BaseCommand):
         self, columns: list[str], csv_writer: Any, buffer: io.StringIO
     ) -> tuple[str, int]:
         """Write CSV header and return header data with byte count."""
-        # Mirror the non-streaming export path (df_to_escaped_csv): header
-        # cells can carry attacker-influenced labels, so neutralize
-        # spreadsheet formula prefixes here too.
-        csv_writer.writerow(
-            [
-                escape_value(column) if isinstance(column, str) else column
-                for column in columns
-            ]
-        )
+        csv_writer.writerow(columns)
         header_data = buffer.getvalue()
         total_bytes = len(header_data.encode("utf-8"))
         buffer.seek(0)
@@ -130,8 +121,7 @@ class BaseStreamingCSVExportCommand(BaseCommand):
         self, row: tuple[Any, ...], decimal_separator: str | None
     ) -> list[Any]:
         """
-        Format row values: escape string cells against CSV formula injection
-        and apply the custom decimal separator if specified.
+        Format row values, applying custom decimal separator if specified.
 
         Args:
             row: Database row as a tuple
@@ -140,30 +130,20 @@ class BaseStreamingCSVExportCommand(BaseCommand):
         Returns:
             List of formatted values
         """
-        active_decimal_separator = (
-            decimal_separator
-            if decimal_separator and decimal_separator != "."
-            else None
-        )
+        if not decimal_separator or decimal_separator == ".":
+            return list(row)
 
         formatted: list[Any] = []
         for value in row:
-            # Escape string cells so spreadsheet formula prefixes (= + - @ |,
-            # leading tab/CR) are neutralized, mirroring the non-streaming
-            # CSV path (superset.utils.csv.df_to_escaped_csv).
-            if isinstance(value, str):
-                formatted.append(escape_value(value))
             # Apply the custom decimal separator to any real numeric value
             # (float, decimal.Decimal, numpy numeric types, ...). Booleans are
             # technically a numeric type in Python but should never be rewritten
             # as numbers in CSV output.
-            elif isinstance(value, bool):
+            if isinstance(value, bool):
                 formatted.append(value)
-            elif active_decimal_separator is not None and isinstance(
-                value, (float, Decimal, Real)
-            ):
+            elif isinstance(value, (float, Decimal, Real)):
                 # Format numeric values with custom decimal separator
-                formatted.append(str(value).replace(".", active_decimal_separator))
+                formatted.append(str(value).replace(".", decimal_separator))
             else:
                 formatted.append(value)
         return formatted

superset/common/form_data_query_context.py

@@ -213,9 +213,7 @@ def orderby_from_form_data(
     # The drag-and-drop "sort by" control persists a list; the frontend unwraps it
     # with ``ensureIsArray(...)[0]`` (``plugin-chart-table/src/buildQuery.ts:67``).
     # Read raw, a list would nest inside ``orderby`` and fail the query.
-    raw_sort_metric = form_data.get("series_limit_metric") or form_data.get(
-        "timeseries_limit_metric"
-    )
+    raw_sort_metric = form_data.get("timeseries_limit_metric")
     sort_metric = (
         next(iter(as_list(raw_sort_metric)), None) if raw_sort_metric else None
     ) or (metrics[0] if form_data.get("sort_by_metric") else None)

superset/daos/report.py

@@ -180,27 +180,17 @@ class ReportScheduleDAO(BaseDAO[ReportSchedule]):
 
     @staticmethod
     def validate_unique_creation_method(
-        dashboard_id: int | None = None,
-        chart_id: int | None = None,
-        creation_method: str | None = None,
+        dashboard_id: int | None = None, chart_id: int | None = None
     ) -> bool:
         """
-        Validate if the user already has a chart or dashboard with a report
-        attached that was created via the same creation method as the one
-        being validated. Only reports created through the same method (e.g.
-        two "charts"-sourced reports) compete for the one-per-object slot --
-        an unrelated self-subscribed alert/report (creation method
-        "alerts_reports") on the same chart or dashboard doesn't count
-        against it.
+        Validate if the user already has a chart or dashboard
+        with a report attached form the self subscribe reports
         """
 
         query = db.session.query(ReportSchedule).filter_by(created_by_fk=get_user_id())
         if dashboard_id is not None:
             query = query.filter(ReportSchedule.dashboard_id == dashboard_id)
 
-        if creation_method is not None:
-            query = query.filter(ReportSchedule.creation_method == creation_method)
-
         if chart_id is not None:
             query = query.filter(ReportSchedule.chart_id == chart_id)
 

superset/dashboards/api.py

@@ -74,7 +74,6 @@ from superset.commands.dashboard.export_example import ExportExampleCommand
 from superset.commands.dashboard.fave import AddFavoriteDashboardCommand
 from superset.commands.dashboard.importers.dispatcher import ImportDashboardsCommand
 from superset.commands.dashboard.permalink.create import CreateDashboardPermalinkCommand
-from superset.commands.dashboard.permalink.get import GetDashboardPermalinkCommand
 from superset.commands.dashboard.restore import RestoreDashboardCommand
 from superset.commands.dashboard.unfave import DelFavoriteDashboardCommand
 from superset.commands.dashboard.update import (
@@ -106,7 +105,6 @@ from superset.dashboards.filters import (
     DashboardTagNameFilter,
     DashboardTitleOrSlugFilter,
 )
-from superset.dashboards.permalink.exceptions import DashboardPermalinkGetFailedError
 from superset.dashboards.permalink.types import DashboardPermalinkState
 from superset.dashboards.schemas import (
     CacheScreenshotSchema,
@@ -142,10 +140,7 @@ from superset.extensions import event_logger, security_manager
 from superset.models.dashboard import Dashboard
 from superset.models.embedded_dashboard import EmbeddedDashboard
 from superset.security.guest_token import GuestUser
-from superset.security.manager import (
-    get_extra_editor_subject_ids,
-    get_extra_editors_by_pk,
-)
+from superset.security.manager import get_extra_editor_subject_ids
 from superset.subjects.filters import (
     FilterRelatedSubjects,
     subject_type_filter,
@@ -436,15 +431,6 @@ class DashboardRestApi(
         """
         return super().get_list(**kwargs)
 
-    def pre_get_list(self, data: dict[str, Any]) -> None:
-        """Attach ``extra_editors`` to each row, matching the single-object GET."""
-        super().pre_get_list(data)
-        ids = data.get("ids", [])
-        extra_editors_by_id = get_extra_editors_by_pk(Dashboard, ids)
-        for row, row_id in zip(data.get("result", []), ids, strict=False):
-            if row_id in extra_editors_by_id:
-                row["extra_editors"] = extra_editors_by_id[row_id]
-
     list_select_columns = list_columns + ["changed_on", "created_on", "changed_by_fk"]
     order_columns = [
         "changed_by.first_name",
@@ -1856,43 +1842,6 @@ class DashboardRestApi(
             raise
         return self.response(202, job_id=job_id)
 
-    def _validate_permalink_for_dashboard(
-        self, permalink_key: str, dashboard: Dashboard
-    ) -> WerkzeugResponse | None:
-        """
-        Resolve (and access-check, as the calling user) a caller-supplied
-        permalink key, and confirm it belongs to `dashboard`.
-
-        A permalink key is resolved as the calling user, before it's ever
-        handed to the (potentially more-privileged) screenshot executor --
-        otherwise a caller with access only to `dashboard` could pass the
-        permalink key of a dashboard they can't access and have it rendered
-        under the executor's identity.
-
-        :returns: An error response if the key doesn't resolve, isn't
-            accessible to the caller, or belongs to a different dashboard;
-            ``None`` if it's valid for `dashboard`.
-        """
-        try:
-            permalink_value = GetDashboardPermalinkCommand(permalink_key).run()
-        except DashboardPermalinkGetFailedError:
-            return self.response_404()
-        except DashboardAccessDeniedError:
-            return self.response_403()
-        if not permalink_value:
-            return self.response_404()
-        try:
-            permalink_dashboard = DashboardDAO.get_by_id_or_slug(
-                permalink_value["dashboardId"]
-            )
-        except DashboardAccessDeniedError:
-            return self.response_403()
-        except DashboardNotFoundError:
-            return self.response_404()
-        if permalink_dashboard.id != dashboard.id:
-            return self.response_403()
-        return None
-
     @expose("/<pk>/cache_dashboard_screenshot/", methods=("POST",))
     @validate_feature_flags(["THUMBNAILS", "ENABLE_DASHBOARD_SCREENSHOT_ENDPOINTS"])
     @protect()
@@ -1963,17 +1912,13 @@ class DashboardRestApi(
 
         # if the permalink key is provided, dashboard_state will be ignored
         # else, create a permalink key from the dashboard_state
-        permalink_key = payload.get("permalinkKey", None)
-        if permalink_key:
-            if error_response := self._validate_permalink_for_dashboard(
-                permalink_key, dashboard
-            ):
-                return error_response
-        else:
-            permalink_key = CreateDashboardPermalinkCommand(
+        permalink_key = (
+            payload.get("permalinkKey", None)
+            or CreateDashboardPermalinkCommand(
                 dashboard_id=str(dashboard.id),
                 state=dashboard_state,
             ).run()
+        )
 
         dashboard_url = get_url_path("Superset.dashboard_permalink", key=permalink_key)
         screenshot_obj = DashboardScreenshot(dashboard_url, dashboard.digest)
@@ -1995,9 +1940,7 @@ class DashboardRestApi(
                 task_status=cache_payload.get_status(),
             )
 
-        if cache_payload.should_trigger_task(
-            force, expected_scope=f"dashboard:{dashboard.id}"
-        ):
+        if cache_payload.should_trigger_task(force):
             logger.info("Triggering screenshot ASYNC")
             cache_dashboard_screenshot.delay(
                 username=get_current_user(),
@@ -2076,12 +2019,6 @@ class DashboardRestApi(
         # fetch the dashboard screenshot using the current user and cache if set
 
         if cache_payload := DashboardScreenshot.get_from_cache_key(digest):
-            # The digest is caller-supplied and cache entries are shared across
-            # every dashboard (and, via the same backend, charts) -- without
-            # this check any cache_key learned for one dashboard would serve
-            # its image under a different, merely-accessible `pk`.
-            if cache_payload.get_scope() != f"dashboard:{dashboard.id}":
-                return self.response_404()
             try:
                 image = cache_payload.get_image()
             except ScreenshotImageNotAvailableException:

superset/datasets/api.py

@@ -1757,6 +1757,8 @@ class DatasetRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
             "columns.column_name",
             "columns.verbose_name",
             "columns.groupby",
+            "metrics.metric_name",
+            "metrics.verbose_name",
         ]
         dataset_schema = DatasetDrillInfoSchema()
 

superset/datasets/schemas.py

@@ -479,6 +479,11 @@ class DatasetColumnDrillInfoSchema(Schema):
     verbose_name = fields.String(required=False)
 
 
+class DatasetMetricDrillInfoSchema(Schema):
+    metric_name = fields.String(required=True)
+    verbose_name = fields.String(required=False)
+
+
 class UserSchema(Schema):
     first_name = fields.String()
     last_name = fields.String()
@@ -488,6 +493,7 @@ class UserSchema(Schema):
 class DatasetDrillInfoSchema(Schema):
     id = fields.Integer()
     columns = fields.List(fields.Nested(DatasetColumnDrillInfoSchema))
+    metrics = fields.List(fields.Nested(DatasetMetricDrillInfoSchema))
     table_name = fields.String()
     editors = fields.List(fields.Nested(SubjectResponseSchema))
     created_by = fields.Nested(UserSchema)
@@ -503,6 +509,9 @@ class DatasetDrillInfoSchema(Schema):
         """
         Clear API response to avoid exposing sensitive information for embedded users,
         and filter columns to only include those with groupby=True for drill operations.
+        Metrics are passed through unfiltered since they are used to resolve display
+        labels (e.g. for the dashboard "View as table" results grid) rather than for
+        drill-by dimension selection.
         """
         dimensions = {
             col.column_name
@@ -516,5 +525,9 @@ class DatasetDrillInfoSchema(Schema):
         ]
 
         if security_manager.is_guest_user():
-            return {"id": serialized["id"], "columns": serialized["columns"]}
+            return {
+                "id": serialized["id"],
+                "columns": serialized["columns"],
+                "metrics": serialized.get("metrics", []),
+            }
         return serialized

superset/db_engine_specs/base.py

@@ -3037,11 +3037,6 @@ class BasicParametersMixin:
     # for Databend this would be `{"sslmode": "disable"}`, eg.
     encryption_disable_parameters: dict[str, str] = {}
 
-    # parameters that `validate_parameters` treats as mandatory; subclasses
-    # override this to relax a parameter (e.g. `port`) without duplicating
-    # the rest of `validate_parameters`
-    required_parameters: set[str] = {"host", "port", "username", "database"}
-
     @classmethod
     def build_sqlalchemy_uri(  # pylint: disable=unused-argument
         cls,
@@ -3113,7 +3108,7 @@ class BasicParametersMixin:
         """
         errors: list[SupersetError] = []
 
-        required = cls.required_parameters
+        required = {"host", "port", "username", "database"}
         parameters = properties.get("parameters", {})
         present = {key for key in parameters if parameters.get(key, ())}
 
@@ -3142,7 +3137,7 @@ class BasicParametersMixin:
             return errors
 
         port = parameters.get("port", None)
-        if port is None or port == "":
+        if not port:
             return errors
         try:
             port = int(port)

superset/db_engine_specs/postgres.py

@@ -25,8 +25,6 @@ from typing import Any, Callable, Optional, TYPE_CHECKING
 
 import sqlalchemy as sa
 from flask_babel import gettext as __
-from marshmallow import fields, pre_load
-from marshmallow.validate import Range
 from sqlalchemy import text, types
 from sqlalchemy.dialects.postgresql import DOUBLE_PRECISION, ENUM, INTERVAL, JSON
 from sqlalchemy.dialects.postgresql.base import PGInspector
@@ -41,8 +39,6 @@ from superset.db_engine_specs.base import (
     AURORA_DATA_API_KNOWN_INCOMPATIBILITIES,
     BaseEngineSpec,
     BasicParametersMixin,
-    BasicParametersSchema,
-    BasicParametersType,
     DatabaseCategory,
     TimestampExpression,
 )
@@ -323,34 +319,6 @@ class PostgresBaseEngineSpec(BaseEngineSpec):
         return None
 
 
-class PostgresParametersSchema(BasicParametersSchema):
-    """
-    Same as ``BasicParametersSchema``, except ``port`` is optional: a blank
-    port falls back to Postgres's own default (5432) in
-    ``PostgresEngineSpec.build_sqlalchemy_uri``.
-    """
-
-    port = fields.Integer(
-        required=False,
-        allow_none=True,
-        metadata={"description": __("Database port")},
-        validate=Range(min=0, max=2**16, max_inclusive=False),
-    )
-
-    @pre_load
-    def blank_port_to_none(self, data: Any, **kwargs: Any) -> Any:
-        """
-        A cleared number input in the Connect Database form submits ``""``
-        for ``port`` (HTML input values are always strings) rather than
-        omitting the key or sending ``null``. Normalize it to ``None`` so it
-        deserializes cleanly instead of failing with "Not a valid integer.",
-        and is treated as blank -- same as an omitted port -- downstream.
-        """
-        if isinstance(data, dict) and data.get("port") == "":
-            data = {**data, "port": None}
-        return data
-
-
 class PostgresEngineSpec(BasicParametersMixin, PostgresBaseEngineSpec):
     engine = "postgresql"
     engine_name = "PostgreSQL"
@@ -362,11 +330,6 @@ class PostgresEngineSpec(BasicParametersMixin, PostgresBaseEngineSpec):
     supports_grouping_sets = True
 
     default_driver = "psycopg2"
-    parameters_schema = PostgresParametersSchema()
-    # ``port`` is intentionally not required: a blank port falls back to
-    # Postgres's own default (``metadata["default_port"]``) in
-    # ``BasicParametersMixin.build_sqlalchemy_uri`` (overridden below).
-    required_parameters = {"host", "username", "database"}
     sqlalchemy_uri_placeholder = (
         "postgresql://user:password@host:port/dbname[?key=value&key=value...]"
     )
@@ -732,34 +695,6 @@ class PostgresEngineSpec(BasicParametersMixin, PostgresBaseEngineSpec):
 
         return uri, connect_args
 
-    @classmethod
-    def build_sqlalchemy_uri(
-        cls,
-        parameters: BasicParametersType,
-        encrypted_extra: dict[str, str] | None = None,
-    ) -> str:
-        """
-        Default a missing/blank port to Postgres's own default (5432) so the
-        dynamic form can connect without requiring the port to be filled in.
-
-        Only an absent key, ``None``, or ``""`` (what a cleared number input
-        submits, since this may be called directly with raw, non-schema-
-        loaded parameters -- see ``ValidateDatabaseParametersCommand``) are
-        treated as blank; an explicitly supplied port -- including ``0`` --
-        is preserved as-is rather than overwritten by a truthiness check.
-        """
-        port = parameters.get("port")
-        resolved_port: int = (
-            cls.metadata["default_port"] if port is None or port == "" else port
-        )
-        parameters_with_default_port: BasicParametersType = {
-            **parameters,
-            "port": resolved_port,
-        }
-        return super().build_sqlalchemy_uri(
-            parameters_with_default_port, encrypted_extra
-        )
-
     @staticmethod
     def mutate_db_for_connection_test(database: Database) -> None:
         """

superset/examples/birth_names.py

@@ -290,7 +290,7 @@ def create_slices(tbl: SqlaTable) -> tuple[list[Slice], list[Slice]]:
                 groupby=["name"],
                 adhoc_filters=[gen_filter("gender", "girl")],
                 row_limit=50,
-                series_limit_metric=metric,
+                timeseries_limit_metric=metric,
                 metrics=[metric],
             ),
             editors=[],
@@ -321,7 +321,7 @@ def create_slices(tbl: SqlaTable) -> tuple[list[Slice], list[Slice]]:
                 groupby=["name"],
                 adhoc_filters=[gen_filter("gender", "boy")],
                 row_limit=50,
-                series_limit_metric=metric,
+                timeseries_limit_metric=metric,
                 metrics=[metric],
             ),
             editors=[],
@@ -498,7 +498,7 @@ def create_slices(tbl: SqlaTable) -> tuple[list[Slice], list[Slice]]:
                 viz_type="echarts_timeseries_line",
                 granularity_sqla="ds",
                 groupby=["name"],
-                series_limit_metric={
+                timeseries_limit_metric={
                     "expressionType": "SIMPLE",
                     "column": {
                         "column_name": "num_california",
@@ -522,7 +522,7 @@ def create_slices(tbl: SqlaTable) -> tuple[list[Slice], list[Slice]]:
                 metrics=metrics,
                 groupby=["name"],
                 row_limit=50,
-                series_limit_metric={
+                timeseries_limit_metric={
                     "expressionType": "SIMPLE",
                     "column": {
                         "column_name": "num_california",

superset/examples/usa_births_names/charts/Boys.yaml

@@ -36,8 +36,8 @@ params:
   metrics:
   - sum__num
   row_limit: 50
-  series_limit_metric: sum__num
   time_range: '100 years ago : now'
+  timeseries_limit_metric: sum__num
   viz_type: table
 query_context: null
 slice_name: Boys

superset/examples/usa_births_names/charts/Girls.yaml

@@ -36,8 +36,8 @@ params:
   metrics:
   - sum__num
   row_limit: 50
-  series_limit_metric: sum__num
   time_range: '100 years ago : now'
+  timeseries_limit_metric: sum__num
   viz_type: table
 query_context: null
 slice_name: Girls

superset/examples/utils.py

@@ -258,7 +258,7 @@ def load_configs_from_directory(
 
     # removing "type" from the metadata allows us to import any exported model
     # from the unzipped directory directly
-    metadata = yaml.safe_load(contents.get(METADATA_FILE_NAME, "{}"))
+    metadata = yaml.load(contents.get(METADATA_FILE_NAME, "{}"), Loader=yaml.Loader)  # noqa: S506
     if "type" in metadata:
         del metadata["type"]
     contents[METADATA_FILE_NAME] = yaml.dump(metadata)

superset/jinja_context.py

@@ -118,51 +118,6 @@ class TimeFilter:
     time_range: str | None
 
 
-class SQLSafeList(list[Any]):  # noqa: FURB189
-    """
-    A list of dialect-escaped values whose *whole-container* string
-    rendering cannot re-introduce raw quote characters.
-
-    Rendering a plain Python list in a Jinja template goes through
-    ``str()``/``repr()``, which wraps every string element in fresh quote
-    delimiters (and switches to double-quote delimiters when the element
-    contains a single quote, emitting that single quote raw). Either way
-    the rendered text can contain quote characters that were never
-    escaped for SQL, so a template interpolating the list inside its own
-    quotes -- e.g. ``LIKE '{{ filter.get('escaped_val') }}'`` -- could be
-    broken out of even though every string leaf was individually escaped.
-    This subclass renders as its (already-escaped) elements joined with
-    ``", "``, with no additional delimiters, so every quote in the output
-    is one the dialect's literal processor already escaped.
-    """
-
-    def __str__(self) -> str:
-        return ", ".join(str(element) for element in self)
-
-    __repr__ = __str__
-
-
-class SQLSafeDict(dict[Any, Any]):  # noqa: FURB189
-    """
-    A dict of dialect-escaped keys and values whose *whole-container*
-    string rendering cannot re-introduce raw quote characters. Mirrors
-    :class:`SQLSafeList` for the mapping case.
-
-    Keys are typically used for member lookups (for example
-    ``{{ get_guest_user_attribute('tenant').id }}``) rather than
-    interpolated into SQL directly, but a template can still render the
-    whole dict -- and a key, like a value, may originate from data the
-    caller does not fully control. Keys are therefore escaped the same
-    way values are, through ``ExtraCache._escape_value``, so whole-dict
-    rendering carries the same guarantee as whole-list rendering.
-    """
-
-    def __str__(self) -> str:
-        return ", ".join(f"{key}: {value}" for key, value in self.items())
-
-    __repr__ = __str__
-
-
 def _normalize_postgresql_backslash_escapes(dialect: Dialect) -> None:
     """Correct a PostgreSQL dialect instance's ``_backslash_escapes`` default
     in place so backslashes round-trip unchanged when the dialect is used to
@@ -508,19 +463,10 @@ class ExtraCache:
         to restore parity with PostgreSQL's default configuration, while
         MySQL/MariaDB keep the stricter, backslash-doubling behavior above.
 
-        Lists are processed element-wise and dict keys/values recursively,
-        so strings nested inside JSON structures are also escaped. Non-string
-        leaf values are left as-is.
-
-        Lists and dicts are returned as :class:`SQLSafeList` /
-        :class:`SQLSafeDict` rather than plain ``list``/``dict``: Jinja
-        renders a whole container through ``str()``/``repr()``, which
-        wraps string elements in fresh quote delimiters that were never
-        escaped, so even a fully-escaped container could re-introduce raw
-        quotes when interpolated as a whole. The safe subclasses render
-        without adding such delimiters, while still comparing equal to
-        (and behaving like) their plain built-in counterparts everywhere
-        else.
+        Lists are processed element-wise and dict values recursively, so
+        strings nested inside JSON structures are also escaped; dict keys
+        are left untouched since they are used for member lookups, not
+        interpolation. Non-string leaf values are left as-is.
         """
         if not self.dialect:
             return val
@@ -529,11 +475,9 @@ class ExtraCache:
             _normalize_postgresql_backslash_escapes(compiler.dialect)
             return compiler.render_literal_value(val, String())[1:-1]
         if isinstance(val, list):
-            return SQLSafeList(self._escape_value(v) for v in val)
+            return [self._escape_value(v) for v in val]
         if isinstance(val, dict):
-            return SQLSafeDict(
-                (self._escape_value(k), self._escape_value(v)) for k, v in val.items()
-            )
+            return {k: self._escape_value(v) for k, v in val.items()}
         return val
 
     def get_filters(self, column: str, remove_filter: bool = False) -> list[Filter]:

superset/mcp_service/server.py

@@ -811,33 +811,15 @@ def _create_auth_provider(flask_app: Any) -> Any | None:
     """
     auth_provider = None
     if auth_factory := flask_app.config.get("MCP_AUTH_FACTORY"):
-        from superset.mcp_service.mcp_config import MCPAuthConfigError
-
         try:
             auth_provider = auth_factory(flask_app)
             logger.info(
                 "Auth provider created from MCP_AUTH_FACTORY: %s",
                 type(auth_provider).__name__ if auth_provider else "None",
             )
-        except MCPAuthConfigError:
-            # Operator-facing config guidance raised by the factory itself;
-            # carries no secret material. Propagate as-is.
-            raise
-        except Exception as ex:
-            # A configured MCP_AUTH_FACTORY that cannot build its provider is a
-            # misconfiguration that must fail closed: falling through would
-            # start the service unauthenticated. Unlike the default factory
-            # below, an operator-supplied factory gives no basis to classify
-            # any of its failures as benign build errors. The original
-            # exception is suppressed (from None) rather than chained because
-            # its message may contain secrets; the type name is enough to
-            # locate the failure.
-            raise MCPAuthConfigError(
-                "MCP_AUTH_FACTORY is configured but raised "
-                f"{type(ex).__name__} while building the auth provider; "
-                "refusing to start the MCP service without authentication. "
-                "Fix the factory or unset MCP_AUTH_FACTORY."
-            ) from None
+        except Exception:
+            # Do not log the exception — it may contain secrets
+            logger.error("Failed to create auth provider from MCP_AUTH_FACTORY")
     elif (
         flask_app.config.get("MCP_AUTH_ENABLED", False)
         or flask_app.config.get("MCP_API_KEY_ENABLED", False)

superset/reports/notifications/webhook.py

@@ -15,7 +15,6 @@
 # specific language governing permissions and limitations
 # under the License.
 
-import ipaddress
 import logging
 from typing import Any
 from urllib.parse import urlparse
@@ -23,9 +22,6 @@ from urllib.parse import urlparse
 import backoff
 import requests
 from flask import current_app
-from requests.adapters import HTTPAdapter
-from urllib3.connection import HTTPConnection, HTTPSConnection
-from urllib3.connectionpool import HTTPConnectionPool, HTTPSConnectionPool
 
 from superset import feature_flag_manager
 from superset.reports.models import ReportRecipientType
@@ -36,116 +32,10 @@ from superset.reports.notifications.exceptions import (
 )
 from superset.utils import json
 from superset.utils.decorators import statsd_gauge
-from superset.utils.network import is_safe_host, is_safe_ip
+from superset.utils.network import is_safe_host
 
 logger = logging.getLogger(__name__)
 
-# Number of characters of a failing response body kept in the server-side log
-# line. Response bodies are never folded into the exception message raised
-# back to the caller -- that message is persisted verbatim as
-# ``ReportExecutionLog.error_message`` and readable via the execution log
-# API, which would otherwise turn the webhook target into a readback oracle
-# for whatever it chooses to return (including an internal host reached via
-# DNS rebinding).
-_LOGGED_RESPONSE_BODY_LIMIT = 500
-
-
-def _sanitize_for_log(text: str) -> str:
-    """
-    Escape newlines and other control characters in text that gets embedded
-    in a log line. The webhook target controls the response body verbatim,
-    so logging it unescaped would let it forge additional log records or
-    corrupt line-oriented log ingestion.
-    """
-    return text.translate(
-        {c: f"\\x{c:02x}" for c in [*range(0x20), 0x7F] if c not in (0x09,)}
-    )
-
-
-def _raise_for_unsafe_peer(conn: HTTPConnection) -> None:
-    """
-    Validate that a connection's actual peer is publicly routable.
-
-    ``_validate_webhook_url`` resolves and checks the hostname once, ahead of
-    time; the connection opened here is resolved independently and may reach
-    a different address (DNS rebinding via a low-TTL record), so the check
-    has to be repeated against the address actually connected to.
-    """
-    sock = conn.sock
-    if sock is None:
-        return
-    peer = sock.getpeername()[0]
-    if not is_safe_ip(ipaddress.ip_address(peer)):
-        raise NotificationParamException("Webhook URL target host is not allowed.")
-
-
-class _PeerValidatingHTTPConnection(HTTPConnection):
-    """HTTP connection that validates the peer address on connect."""
-
-    def connect(self) -> None:
-        super().connect()
-        _raise_for_unsafe_peer(self)
-
-
-class _PeerValidatingHTTPSConnection(HTTPSConnection):
-    """HTTPS connection that validates the peer address after the handshake."""
-
-    def connect(self) -> None:
-        super().connect()
-        _raise_for_unsafe_peer(self)
-
-
-class _PeerValidatingHTTPConnectionPool(HTTPConnectionPool):
-    ConnectionCls = _PeerValidatingHTTPConnection
-
-
-class _PeerValidatingHTTPSConnectionPool(HTTPSConnectionPool):
-    ConnectionCls = _PeerValidatingHTTPSConnection
-
-
-class _PeerValidatingHTTPAdapter(HTTPAdapter):
-    """
-    Transport adapter that routes requests through connection classes which
-    validate the connected peer address, closing the TOCTOU window between
-    the hostname check in ``_validate_webhook_url`` and the connection that
-    ``send()`` actually opens.
-
-    Mirrors the peer-validation approach used for dataset-import data URIs
-    (``superset.commands.dataset.importers.v1.utils``), adapted to
-    ``requests``/``urllib3`` connection pooling instead of ``urllib``.
-    """
-
-    def init_poolmanager(self, *args: Any, **kwargs: Any) -> None:
-        super().init_poolmanager(*args, **kwargs)
-        # Assign a new dict rather than mutating the manager's dict in
-        # place -- the attribute otherwise aliases urllib3's module-global
-        # default scheme-to-pool-class mapping.
-        self.poolmanager.pool_classes_by_scheme = {
-            "http": _PeerValidatingHTTPConnectionPool,
-            "https": _PeerValidatingHTTPSConnectionPool,
-        }
-
-
-def _get_requester() -> Any:
-    """
-    Return the object used to issue the webhook POST -- either the
-    ``requests`` module itself or a ``requests.Session``, both of which
-    expose a compatible ``.post(url, ...)``.
-
-    Operators who explicitly opt into internal webhook targets via
-    ``ALERT_REPORTS_WEBHOOK_ALLOW_INTERNAL_HOSTS`` get the plain ``requests``
-    module (no peer pinning -- internal hosts are the intended destination).
-    Otherwise a session is returned whose transport pins the connection to
-    the address that was actually validated.
-    """
-    if current_app.config["ALERT_REPORTS_WEBHOOK_ALLOW_INTERNAL_HOSTS"]:
-        return requests
-    session = requests.Session()
-    adapter = _PeerValidatingHTTPAdapter()
-    session.mount("http://", adapter)
-    session.mount("https://", adapter)
-    return session
-
 
 class WebhookNotification(BaseNotification):
     """
@@ -284,7 +174,6 @@ class WebhookNotification(BaseNotification):
         payload = self._get_req_payload()
         files = self._get_files()
         timeout = current_app.config["ALERT_REPORTS_WEBHOOK_TIMEOUT"]
-        requester = _get_requester()
 
         try:
             if files:
@@ -295,7 +184,7 @@ class WebhookNotification(BaseNotification):
                     else:
                         data[key] = value
 
-                response = requester.post(
+                response = requests.post(
                     wh_url,
                     data=data,
                     files=files,
@@ -303,7 +192,7 @@ class WebhookNotification(BaseNotification):
                     allow_redirects=False,
                 )
             else:
-                response = requester.post(
+                response = requests.post(
                     wh_url, json=payload, timeout=timeout, allow_redirects=False
                 )
 
@@ -312,29 +201,14 @@ class WebhookNotification(BaseNotification):
             )
 
             if response.status_code >= 500 or response.status_code == 429:
-                # The response body is logged server-side only (and
-                # truncated) -- it must not be folded into the exception
-                # message, which is persisted as the report execution log's
-                # error message and surfaced back to whoever can read that
-                # log, turning the webhook target into a readback oracle.
-                logger.warning(
-                    "Webhook to %s failed with status code %s: %s",
-                    wh_url,
-                    response.status_code,
-                    _sanitize_for_log(response.text[:_LOGGED_RESPONSE_BODY_LIMIT]),
-                )
                 raise NotificationUnprocessableException(
-                    f"Webhook failed with status code {response.status_code}"
+                    f"Webhook failed with status code {response.status_code}: \
+                     {response.text}"
                 )
             if response.status_code >= 400:
-                logger.warning(
-                    "Webhook to %s failed with status code %s: %s",
-                    wh_url,
-                    response.status_code,
-                    _sanitize_for_log(response.text[:_LOGGED_RESPONSE_BODY_LIMIT]),
-                )
                 raise NotificationParamException(
-                    f"Webhook failed with status code {response.status_code}"
+                    f"Webhook failed with status code {response.status_code}: \
+                    {response.text}"
                 )
             if response.status_code >= 300:
                 # Redirects are intentionally not followed (allow_redirects=False),

superset/security/manager.py

@@ -170,36 +170,6 @@ def get_extra_editor_subject_ids(resource: Model) -> list[int]:
     return subject_ids
 
 
-def get_extra_editors_by_pk(
-    model_cls: type[Model], primary_keys: list[Any]
-) -> dict[Any, list[int]]:
-    """
-    Resolve extra editor subject IDs for a batch of resources, keyed by
-    primary key. List responses only have serialized rows, not model
-    instances, so this re-queries the page's rows in one batched query.
-    """
-    if not primary_keys or not (
-        has_app_context() and current_app.config.get("EXTRA_EDITORS_RESOLVER")
-    ):
-        return {}
-
-    # pylint: disable=import-outside-toplevel
-    from superset import db
-    from superset.models.helpers import SKIP_VISIBILITY_FILTER_CLASSES
-
-    pk_col = inspect(model_cls).primary_key[0]
-    resources = (
-        db.session.query(model_cls)
-        .execution_options(**{SKIP_VISIBILITY_FILTER_CLASSES: {model_cls}})
-        .filter(pk_col.in_(primary_keys))
-        .all()
-    )
-    return {
-        getattr(resource, pk_col.name): get_extra_editor_subject_ids(resource)
-        for resource in resources
-    }
-
-
 def _render_permission_instructions_link(
     *,
     datasource_id: str = "",

superset/sql/execution/executor.py

@@ -943,8 +943,6 @@ class SQLExecutor:
         )
 
         cache_key = self._generate_cache_key(sql, opts)
-        if cache_key is None:
-            return None
 
         if (cached := cache_manager.data_cache.get(cache_key)) is not None:
             # Reconstruct statement results from cached data
@@ -984,9 +982,6 @@ class SQLExecutor:
             return
 
         cache_key = self._generate_cache_key(sql, opts)
-        if cache_key is None:
-            return
-
         timeout = (
             (opts.cache.timeout if opts.cache else None)
             or self.database.cache_timeout
@@ -1023,29 +1018,14 @@ class SQLExecutor:
             timeout=timeout,
         )
 
-    def _connection_carries_user_identity(self) -> bool:
-        """
-        Whether the raw connection this executor's database hands out is
-        bound to the calling user's identity (user impersonation or
-        per-user OAuth2 tokens), such that two different users running the
-        identical SQL text can see materially different data because the
-        database itself, not just Superset, distinguishes them.
-        """
-        return bool(self.database.impersonate_user) or self.database.is_oauth2_enabled()
-
-    def _generate_cache_key(self, sql: str, opts: QueryOptions) -> str | None:
+    def _generate_cache_key(self, sql: str, opts: QueryOptions) -> str:
         """
         Generate cache key for query result.
 
         :param sql: SQL query
         :param opts: Query options
-        :returns: Cache key string, or ``None`` if the query must not be
-            cached because the connection carries per-user identity but
-            the effective user could not be determined -- caching in that
-            case would risk serving one user's results to another.
+        :returns: Cache key string
         """
-        from superset.utils.cache_keys import add_impersonation_cache_key_if_needed
-
         # Include relevant options in the cache key
         key_parts = [
             str(self.database.id),
@@ -1054,24 +1034,6 @@ class SQLExecutor:
             opts.schema or "",
             str(opts.limit) if opts.limit is not None else "",
         ]
-
-        if self._connection_carries_user_identity():
-            user_id = utils.get_user_id()
-            if user_id is None:
-                # Effective identity is unknown (e.g. no request context) --
-                # fail safe by refusing to cache rather than risk sharing
-                # results across users.
-                return None
-            key_parts.append(f"user:{user_id}")
-
-        # Mirror the chart-data cache-key path so CACHE_IMPERSONATION /
-        # CACHE_QUERY_BY_USER / per_user_caching semantics also scope the
-        # SQL executor's result cache.
-        impersonation_cache_dict: dict[str, Any] = {}
-        add_impersonation_cache_key_if_needed(self.database, impersonation_cache_dict)
-        if impersonation_key := impersonation_cache_dict.get("impersonation_key"):
-            key_parts.append(f"impersonation:{impersonation_key}")
-
         key_string = "|".join(key_parts)
         return hashlib.sha256(key_string.encode()).hexdigest()
 

superset/tasks/async_queries.py

@@ -106,10 +106,6 @@ def load_chart_data_into_cache(
 ) -> None:
     # pylint: disable=import-outside-toplevel
     from superset.commands.chart.data.get_data_command import ChartDataCommand
-    from superset.commands.chart.exceptions import (
-        ChartDataCacheLoadError,
-        ChartDataQueryFailedError,
-    )
 
     with override_user(_load_user_from_job_metadata(job_metadata), force=False):
         try:
@@ -127,20 +123,6 @@ def load_chart_data_into_cache(
         except SoftTimeLimitExceeded as ex:
             _handle_soft_time_limit(job_metadata, ex, "loading chart data")
             raise
-        except (ChartDataCacheLoadError, ChartDataQueryFailedError) as ex:
-            # These map to 422/400 in the synchronous chart/data endpoint (see
-            # ChartDataRestApi._get_data_response) - expected, client-facing
-            # validation failures (e.g. a chart still referencing columns a
-            # customer has since dropped from the dataset), not application
-            # bugs. The failure is already delivered to the client via
-            # update_job below; re-raising would only surface it a second
-            # time as an unhandled Celery task exception.
-            logger.info("Chart data query failed while loading into cache: %s", ex)
-            async_query_manager.update_job(
-                job_metadata,
-                async_query_manager.STATUS_ERROR,
-                errors=sanitize_error_dicts([{"message": str(ex.message)}]),
-            )
         except Exception as ex:
             # Extract SIP-40 style errors when available
             if isinstance(ex, SupersetErrorException):

superset/tasks/thumbnails.py

@@ -65,7 +65,6 @@ def cache_chart_thumbnail(
     user = security_manager.find_user(username)
     with override_user(user):
         screenshot = ChartScreenshot(url, chart.digest)
-        screenshot.cache_scope = f"chart:{chart.id}"
         screenshot.compute_and_cache(
             user=user,
             window_size=window_size,
@@ -103,7 +102,6 @@ def cache_dashboard_thumbnail(
     user = security_manager.find_user(username)
     with override_user(user):
         screenshot = DashboardScreenshot(url, dashboard.digest)
-        screenshot.cache_scope = f"dashboard:{dashboard.id}"
         resolved_cache_key = cache_key or screenshot.get_cache_key(
             window_size, thumb_size
         )
@@ -151,7 +149,6 @@ def cache_dashboard_screenshot(  # pylint: disable=too-many-arguments
 
     with override_user(current_user):
         screenshot = DashboardScreenshot(dashboard_url, dashboard.digest)
-        screenshot.cache_scope = f"dashboard:{dashboard.id}"
         screenshot.compute_and_cache(
             user=current_user,
             window_size=window_size,

superset/tasks/types.py

@@ -48,10 +48,9 @@ class ExecutorType(StrEnum):
     # The last modifier of the model, if they are an editor directly (user-type subject)
     # or indirectly (their role or group is an editor subject)
     MODIFIER_EDITOR = "modifier_editor"
-    # Whoever authored the model's current state, provided they are also an editor
-    # (directly, or through role/group membership). Prioritizes: modifier -> creator.
-    # Never resolves to any other attached editor -- only the user who actually wrote
-    # the state being executed.
+    # An editor of the model. Resolves to a user who is an editor either directly
+    # or through role/group membership. Prioritizes: modifier -> creator -> first
+    # direct user-type editor -> deterministic user from role/group editors.
     EDITOR = "editor"
 
 

superset/tasks/utils.py

@@ -20,12 +20,13 @@ from __future__ import annotations
 import logging
 import traceback
 from http.client import HTTPResponse
-from typing import cast, TYPE_CHECKING
+from typing import Any, cast, TYPE_CHECKING
 from urllib import request
 from uuid import UUID, uuid4
 
 from celery.utils.log import get_task_logger
 from flask import g
+from sqlalchemy import or_, select
 from superset_core.tasks.types import TaskProperties, TaskScope
 
 from superset.tasks.exceptions import ExecutorNotFoundError, InvalidExecutorError
@@ -40,6 +41,8 @@ from superset.utils.hashing import hash_from_str
 from superset.utils.urls import get_url_path
 
 if TYPE_CHECKING:
+    from flask_appbuilder.security.sqla.models import User
+
     from superset.models.dashboard import Dashboard
     from superset.models.slice import Slice
     from superset.reports.models import ReportSchedule
@@ -49,6 +52,55 @@ logger = get_task_logger(__name__)
 logger.setLevel(logging.INFO)
 
 
+def _get_indirect_editor_user(editors: list[Any]) -> User | None:
+    """Return a deterministic user represented by role/group editor subjects."""
+    from flask_appbuilder.security.sqla.models import (
+        assoc_user_group,
+        assoc_user_role,
+        User,
+    )
+
+    from superset import db
+    from superset.subjects.types import SubjectType
+
+    role_ids = [
+        editor.role_id
+        for editor in editors
+        if editor.type == SubjectType.ROLE and editor.role_id
+    ]
+    group_ids = [
+        editor.group_id
+        for editor in editors
+        if editor.type == SubjectType.GROUP and editor.group_id
+    ]
+    conditions = []
+    if role_ids:
+        conditions.append(
+            User.id.in_(
+                select(assoc_user_role.c.user_id).where(
+                    assoc_user_role.c.role_id.in_(role_ids)
+                )
+            )
+        )
+    if group_ids:
+        conditions.append(
+            User.id.in_(
+                select(assoc_user_group.c.user_id).where(
+                    assoc_user_group.c.group_id.in_(group_ids)
+                )
+            )
+        )
+    if not conditions:
+        return None
+
+    return (
+        db.session.query(User)
+        .filter(User.active.is_(True), or_(*conditions))
+        .order_by(User.id)
+        .first()
+    )
+
+
 # pylint: disable=too-many-branches
 def get_executor(  # noqa: C901
     executors: list[Executor],
@@ -60,14 +112,9 @@ def get_executor(  # noqa: C901
     types extract the user from the underlying object (e.g. CREATOR), a fixed user
     account, or the user that initiated the request.
 
-    The CREATOR_EDITOR, MODIFIER_EDITOR, and EDITOR types additionally require the
-    resolved user (the model's creator or modifier) to be an editor of the model,
-    directly (user-type subject) or indirectly (through a role/group subject). They
-    never resolve to any *other* attached editor: editor subjects can be attached to
-    a model by whoever creates or edits it with no consent from the attached user, so
-    resolving to an arbitrary attached editor would let a low-privileged creator or
-    modifier arrange for the task to execute as a different, potentially
-    higher-privileged, user.
+    The EDITOR, CREATOR_EDITOR, and MODIFIER_EDITOR types resolve users from the model's
+    editors (subjects). These check both direct user-type subjects and indirect
+    membership through role/group subjects.
 
     :param executors: The requested executor in descending order. When the
            first user is found it is returned.
@@ -81,6 +128,7 @@ def get_executor(  # noqa: C901
     :raises ExecutorNotFoundError: If no users were found in after
             iterating through all entries in `executors`
     """
+    from superset.subjects.types import SubjectType
     from superset.subjects.utils import get_user_subject_ids
 
     # Build set of all subject IDs that are editors of this model
@@ -92,6 +140,13 @@ def get_executor(  # noqa: C901
             return False
         return bool(set(get_user_subject_ids(user_id)) & editor_subject_ids)
 
+    # Direct user-type editors (for EDITOR fallback resolution)
+    editor_users = [
+        e.user
+        for e in getattr(model, "editors", [])
+        if e.type == SubjectType.USER and e.user is not None
+    ]
+
     for executor in executors:
         if isinstance(executor, FixedExecutor):
             return ExecutorType.FIXED_USER, executor.username
@@ -112,15 +167,11 @@ def get_executor(  # noqa: C901
             if (user := model.changed_by) and user.is_active:
                 return executor, user.username
         if executor == ExecutorType.EDITOR:
-            # Priority: modifier -> creator. Resolves only to whoever authored
-            # the model's current state -- changed_by/created_by are set by the
-            # framework from the authenticated session on write, so a caller
-            # who edits the object becomes changed_by themselves and cannot
-            # point this at a victim. Deliberately does NOT fall through to an
-            # arbitrary other attached editor (direct or via role/group
-            # membership): that would let a low-privileged creator/modifier
-            # attach a higher-privileged user as an editor with no consent and
-            # have the task execute with that victim's credentials.
+            # Priority: modifier → creator → direct user editor → indirect editor.
+            # Inactive users are skipped at every step so that scheduling can
+            # fall through to another active owner/editor instead of failing
+            # outright (see: ExecutorNotFoundError only once no active
+            # candidate remains).
             if (
                 (modifier := model.changed_by)
                 and modifier.is_active
@@ -133,6 +184,14 @@ def get_executor(  # noqa: C901
                 and _is_editor(creator.id)
             ):
                 return executor, creator.username
+            if active_editor_user := next(
+                (user for user in editor_users if user.is_active), None
+            ):
+                return executor, active_editor_user.username
+            if indirect_editor := _get_indirect_editor_user(
+                getattr(model, "editors", [])
+            ):
+                return executor, indirect_editor.username
 
     raise ExecutorNotFoundError()
 

superset/thumbnails/digest.py

@@ -62,18 +62,9 @@ def _adjust_string_with_rls(
     Add the RLS filters to the unique string based on current executor.
     """
 
-    # Prefer the ambient guest user (the actual requesting principal) over a
-    # DB-user lookup by username: for guest requests `executor` is the
-    # token-supplied username, which can collide with a real DB username. If
-    # find_user() were tried first, a collision would compute RLS under the
-    # unrelated DB user's identity, and the token's own per-token rls claims
-    # (surfaced via get_guest_rls_filters(), which reads the ambient guest
-    # user installed by override_user() below) would never enter the digest --
-    # letting two guest tokens with the same username but different rls
-    # collide on one cache entry.
     user = (
-        security_manager.get_current_guest_user_if_guest()
-        or security_manager.find_user(executor)
+        security_manager.find_user(executor)
+        or security_manager.get_current_guest_user_if_guest()
     )
 
     if user:

superset/utils/excel.py

@@ -47,34 +47,20 @@ NEUTRAL_DOCUMENT_PROPERTIES: dict[str, Any] = {
 FORMULA_PREFIXES = {"=", "+", "-", "@"}
 
 
-def _quote_formula(value: Any) -> Any:
-    """Prefix a string with a quote when it would parse as a formula."""
-    return (
-        f"'{value}"
-        if isinstance(value, str) and len(value) and value[0] in FORMULA_PREFIXES
-        else value
-    )
-
-
 def quote_formulas(df: pd.DataFrame) -> pd.DataFrame:
     """
     Make sure to quote any formulas for security reasons.
     """
     for col in df.select_dtypes(include="object").columns:
-        df[col] = df[col].apply(_quote_formula)
+        df[col] = df[col].apply(
+            lambda x: (
+                f"'{x}"
+                if isinstance(x, str) and len(x) and x[0] in FORMULA_PREFIXES
+                else x
+            )
+        )
 
-    # Column headers and index labels are written to the sheet as well, and
-    # pivot exports promote data values into both (a hostile warehouse string
-    # can become a header or row label), so quote them like the CSV writer
-    # quotes its headers. ``rename`` applies the mapper to every level of a
-    # MultiIndex.
-    df = df.rename(columns=_quote_formula, index=_quote_formula)
-
-    # ``rename`` above only touches axis *labels*. The axis *names* (e.g. a
-    # pivoted group-by column promoted to ``df.index.name``, or per-level
-    # names on a MultiIndex) are a separate attribute that pandas still
-    # writes into the sheet as header cells, so quote those too.
-    return df.rename_axis(index=_quote_formula, columns=_quote_formula)
+    return df
 
 
 def df_to_excel(df: pd.DataFrame, **kwargs: Any) -> Any:

superset/utils/pandas_postprocessing/histogram.py

@@ -17,17 +17,8 @@
 from __future__ import annotations
 
 import numpy as np
-from flask_babel import gettext as _
 from pandas import DataFrame, Series, to_numeric
 
-from superset.exceptions import InvalidPostProcessingError
-
-# Upper bound on the number of histogram bins. ``bins`` arrives through the
-# post-processing ``options`` dict, which is not schema-validated, so the cap
-# must be enforced here: numpy allocates a bin-edge array proportional to
-# ``bins`` (e.g. bins=2e9 attempts a ~16 GB allocation in a single request).
-MAX_HISTOGRAM_BINS = 1000
-
 
 # pylint: disable=too-many-arguments
 def histogram(
@@ -54,18 +45,6 @@ def histogram(
                and each column corresponds to a histogram bin. The values are the counts in each bin.
     """  # noqa: E501
 
-    if (
-        not isinstance(bins, int)
-        or isinstance(bins, bool)
-        or not 1 <= bins <= MAX_HISTOGRAM_BINS
-    ):
-        raise InvalidPostProcessingError(
-            _(
-                "`bins` must be an integer between 1 and %(max)s",
-                max=MAX_HISTOGRAM_BINS,
-            )
-        )
-
     if groupby is None:
         groupby = []
 

superset/utils/pandas_postprocessing/prophet.py

@@ -136,21 +136,6 @@ def prophet(  # pylint: disable=too-many-arguments  # noqa: C901
     # union types
     if not isinstance(periods, int) or periods < 0:
         raise InvalidPostProcessingError(_("Periods must be a whole number"))
-    # The schema-declared upper bound is documentation-only for the raw
-    # post-processing ``options`` dict, so enforce it here: every forecast
-    # period adds a future row per series, making unbounded values an
-    # allocation amplifier. Imported locally to avoid a circular import
-    # (charts.schemas imports this package at module load).
-    # pylint: disable=import-outside-toplevel
-    from superset.charts.schemas import get_max_prophet_periods
-
-    if periods > (max_periods := get_max_prophet_periods()):
-        raise InvalidPostProcessingError(
-            _(
-                "Periods must not exceed %(max)s",
-                max=max_periods,
-            )
-        )
     if not confidence_interval or confidence_interval <= 0 or confidence_interval >= 1:
         raise InvalidPostProcessingError(
             _("Confidence interval must be between 0 and 1 (exclusive)")

superset/utils/pandas_postprocessing/resample.py

@@ -22,12 +22,6 @@ from flask_babel import gettext as _
 from superset.exceptions import InvalidPostProcessingError
 from superset.utils.pandas_postprocessing.utils import RESAMPLE_METHOD
 
-# Upper bound on the number of rows a resample may project. ``rule`` arrives
-# through the post-processing ``options`` dict, which is not schema-validated;
-# without a cap, upsampling a multi-day span to e.g. ``1ns`` projects ~1e14
-# rows from a single request.
-MAX_RESAMPLE_ROWS = 1_000_000
-
 
 def resample(
     df: pd.DataFrame,
@@ -52,32 +46,6 @@ def resample(
             _("Resample method should be in ") + ", ".join(RESAMPLE_METHOD) + "."
         )
 
-    if len(df):
-        try:
-            step = pd.Timedelta(pd.tseries.frequencies.to_offset(rule))
-        except ValueError:
-            # Non-fixed frequencies (month, quarter, year) have no fixed
-            # Timedelta; their projected row count is bounded by the span in
-            # days and needs no cap. Invalid rules fail in ``df.resample``.
-            step = None
-        if step is not None and step.value > 0:
-            span = df.index.max() - df.index.min()
-            # pandas snaps the first resample bin to the nearest frequency
-            # multiple at or before the observed span (and may extend the
-            # last bin similarly), so the actual bin count can exceed a
-            # naive span/step projection by one. Add a margin so the check
-            # cannot under-count due to that alignment.
-            projected_rows = span.value // step.value + 2
-            if projected_rows > MAX_RESAMPLE_ROWS:
-                raise InvalidPostProcessingError(
-                    _(
-                        "Resample rule would project %(rows)s rows, "
-                        "exceeding the limit of %(max)s rows",
-                        rows=projected_rows,
-                        max=MAX_RESAMPLE_ROWS,
-                    )
-                )
-
     if method == "asfreq" and fill_value is not None:
         _df = df.resample(rule).asfreq(fill_value=fill_value)
         _df = _df.fillna(fill_value)

superset/utils/pandas_postprocessing/rolling.py

@@ -26,12 +26,6 @@ from superset.utils.pandas_postprocessing.utils import (
     validate_column_args,
 )
 
-# Upper bound on integer window sizes, matching the documented schema range
-# (1-10000). ``window`` arrives through the post-processing ``options`` dict,
-# which is not schema-validated; a huge integer window combined with
-# ``win_type`` makes scipy allocate a weights array proportional to it.
-MAX_ROLLING_WINDOW = 10_000
-
 
 @validate_column_args("columns")
 def rolling(  # pylint: disable=too-many-arguments
@@ -73,15 +67,6 @@ def rolling(  # pylint: disable=too-many-arguments
         raise InvalidPostProcessingError(_("Undefined window for rolling operation"))
     if window == 0:
         raise InvalidPostProcessingError(_("Window must be > 0"))
-    # Offset-string windows (e.g. "2D") are bounded by the data span and are
-    # left to pandas to validate; only integer windows are capped.
-    if isinstance(window, int) and window > MAX_ROLLING_WINDOW:
-        raise InvalidPostProcessingError(
-            _(
-                "Window must not exceed %(max)s",
-                max=MAX_ROLLING_WINDOW,
-            )
-        )
 
     kwargs["window"] = window
     if min_periods is not None: