rusackasandClaude Opus 4.8 3c209290af fix: document 403 responses on semantic-view endpoints; close unterminated-script XSS gap in SVG sanitizer ...

- Add the missing 403 OpenAPI response to the semantic-view structure and
  delete endpoints, matching the raise_for_access/response_403 calls they
  already make.
- Fix sanitize_svg_content to drop everything after an unterminated
  <script> opener instead of just the tag itself, since browsers treat an
  unterminated <script> as consuming the rest of the document. Strengthen
  the regression test to assert the payload text is gone too.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-21 10:48:10 -07:00

..

__init__.py

…

cache_test.py

feat(cache): add DATA_CACHE_MAX_VALUE_SIZE to skip caching oversized results (#42570)

2026-07-29 11:35:42 -07:00

csv_tests.py

perf(csv): avoid regex in CSV value escaping (#40195)

2026-07-11 11:52:50 -07:00

currency_test.py

…

date_parser_tests.py

fix(charts): align grain-less time comparisons safely (#43315)

2026-08-20 14:55:01 -07:00

db.py

…

encrypt_test.py

fix(encrypt): stop naive padding from truncating secrets ending in '*' (#43074)

2026-08-13 13:15:37 -07:00

excel_streaming_tests.py

feat(dashboard): export dashboard chart data to Excel (async, S3 + email) (#41133)

2026-07-21 12:17:00 -04:00

excel_tests.py

chore(excel): strip document metadata from Excel exports (#40661)

2026-06-02 11:48:36 -07:00

filters_test.py

chore: Unset future flag in engines and sessions. (#43273)

2026-08-20 10:58:37 -07:00

json_tests.py

fix(sqllab): show non-ASCII text in array/JSON columns instead of \uXXXX escapes (#41533)

2026-07-01 10:22:11 -07:00

log_tests.py

…

map_type_tests.py

fix(core): reduce metric expression log noise (#42619)

2026-08-04 16:35:02 -07:00

number_format_test.py

fix(reports): apply chart number and currency formatting to tables sent as text (#42820)

2026-08-11 21:48:37 -07:00

oauth2_tests.py

fix(oauth2): log database token failures (#42644)

2026-08-13 12:54:55 -04:00

pandas_sqlalchemy_compat_test.py

chore: Unset future flag in engines and sessions. (#43273)

2026-08-20 10:58:37 -07:00

profiler_test.py

chore(deps-dev): bump pyinstrument from 4.4.0 to 5.1.2 (#40377)

2026-06-01 13:34:12 -07:00

rls_test.py

fix: bind permission-sync task to user id, use per-user RLS cache sentinel on parse failure (#42938)

2026-08-11 19:35:40 -07:00

s3_tests.py

feat(dashboard): export dashboard chart data to Excel (async, S3 + email) (#41133)

2026-07-21 12:17:00 -04:00

screenshot_test.py

feat(Reports&Alerts): remove Selenium support, require Playwright (#43028)

2026-08-11 16:06:26 -07:00

slack_test.py

fix(reports): preserve Slack v1 private-channel text delivery (#42089)

2026-08-12 14:42:57 -07:00

test_cache_manager.py

…

test_core.py

fix: document 403 responses on semantic-view endpoints; close unterminated-script XSS gap in SVG sanitizer

2026-08-21 10:48:10 -07:00

test_database.py

…

test_date_parsing.py

test: add edge-case tests for datetime_to_epoch function (#39404)

2026-07-11 11:51:46 -07:00

test_decorators.py

fix(reports): preserve Slack v1 private-channel text delivery (#42089)

2026-08-12 14:42:57 -07:00

test_encrypt_cbc_iv_reuse.py

fix(encrypt): stop naive padding from truncating secrets ending in '*' (#43074)

2026-08-13 13:15:37 -07:00

test_error_sanitization.py

fix(embedded): redact database errors in API responses to guest users (#42796)

2026-08-10 18:45:20 +03:00

test_file.py

fix(export): sanitize control characters in titles to prevent export failures (#39294)

2026-06-24 11:03:46 -07:00

test_hashing.py

…

test_impersonation_cache_key.py

fix: Enforce per-user caching on legacy API endpoint (#39789)

2026-04-30 18:04:33 -03:00

test_jinja_template_validator.py

…

test_link_redirect.py

fix(api): improved request handling and embedded dashboard scoping (#42930)

2026-08-17 23:50:25 -07:00

test_network.py

fix(api): improved request handling and embedded dashboard scoping (#42930)

2026-08-17 23:50:25 -07:00

test_report_execution.py

fix(reports): enforce dashboard readiness and execution budget (#42624)

2026-08-05 14:30:35 -07:00

test_rison_filters.py

feat(dashboard): add Rison-encoded URL filter support (#39795)

2026-05-31 08:06:09 -04:00

test_screenshot_cache_fix.py

fix(screenshots): validate cached screenshot image bytes on read and write (#42120)

2026-07-31 15:13:59 -07:00

test_screenshot_exception_handling.py

…

test_screenshot_utils.py

fix(reports): wait for ECharts paint before capturing report screenshots (#43077)

2026-08-18 00:02:36 -04:00

test_split.py

test(core): add unit tests for split function (#40819)

2026-06-10 16:12:35 -07:00

urls_tests.py

fix(utils): urls preserve query params (#35936)

2026-07-07 17:11:19 -07:00

version_test.py

fix(config): expose build details (git SHA/build number) to admins only (#41301)

2026-06-26 12:08:04 -07:00

webdriver_test.py

fix(reports): prevent blank/partial report PDFs from virtualized charts (#43348)

2026-08-20 09:10:30 -04:00