Joe Li 3922c7fc1e fix(subdirectory): CodeQL hardening for redirect + nav helpers ...

Address CodeQL alerts surfaced on the subdirectory-deployment hardening
work:

- `superset/views/utils.py` (`get_explore_redirect_url`): build the
  redirect target via `url_for("ExploreView.root", **query)` instead of
  `f"{url_for(...)}?{urlencode(...)}"`. String-concat with `urlencode`
  was flagged by `py/url-redirection`; the kwargs-splat form is the
  sanctioned Flask URL builder. `parse_qs` lists are flattened to
  scalars first so the splat type-checks against Flask's `url_for`
  signature, and `loads_request_json` now coerces non-object payloads
  to `{}` so the loop guard's `.update()` chain cannot crash on a
  scalar `form_data=42`.
- `superset-frontend/src/utils/navigationUtils.ts` (`navigateTo` /
  `navigateWithState`): replace the throw-based `assertSafeNavigationUrl`
  guard with an inline regex check that CodeQL's data-flow recognises
  as a sanitiser barrier at each `window.*` sink. Behaviour is
  unchanged; the new `isSafeNavigationUrl` predicate mirrors the
  through-function guard exactly.
- `AnnotationLayer.tsx`: migrate the `<a href={ensureAppRoot(...)}>`
  shape to `<AppLink>` so the sanitiser sits inside the helper
  component CodeQL already recognises.

Test fixes wired up alongside the redirect refactor:

- `test_explore_redirect.py`: use `appbuilder.app.url_map` (the
  property `appbuilder.get_app` is gone), and assert against the
  positional `CommandParameters` dataclass passed to
  `CreateFormDataCommand` rather than kwargs.
- `test_legacy_prefix_redirect.py`: walk the `wsgi_app` chain when
  asserting the fake inner middleware survives — `create_app()` now
  inserts `ExtensionCacheMiddleware` between the shim and the test
  fake, so the layering invariant is "shim outside `init_app`'s
  wraps," not "shim's direct inner is `init_app`'s outermost wrap."
- `navigationUtils.invariants.test.ts`: drop the now-stale
  `OAuth2RedirectMessage.tsx` entry from `DIRECT_DOM_NAV_SANCTIONED`
  (the file no longer calls `window.open`).
- `ChartList.listview.test.tsx`: update the dashboard-crosslink
  expectation to `/dashboard/<id>` after the `Superset.route_base = ""`
  cleanup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-23 10:48:08 -07:00

..

__init__.py

…

test_legacy_prefix_redirect.py

…