mirror of
https://github.com/apache/superset.git
synced 2026-07-19 13:15:49 +00:00
1d69cd9f0b
Conflicts arose where master PR #40546 ("fix: sanitize URL sinks and trim sensitive log fields") wrapped `window.*` / `<a href>` sinks with `sanitizeUrl` from @braintree/sanitize-url. This branch's hardening provides a strictly stronger superset of that protection: scheme allowlist, AF-1 backslash rejection, nit-3 userinfo rejection, plus CodeQL-recognised through-function sanitisers (URL constructor + literal-equality, encodeURI). Took HEAD's body in all three conflict sites; dropped the now-unused `sanitizeUrl` import from ResultSet, SaveDatasetModal, and navigationUtils. The library remains a project dep (used by ListViewCard, SqlAlchemyForm, GenericLink, etc.). Conflict sites: - superset-frontend/src/utils/navigationUtils.ts - superset-frontend/src/SqlLab/components/ResultSet/index.tsx - superset-frontend/src/SqlLab/components/SaveDatasetModal/index.tsx Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>