mirror of
https://github.com/apache/superset.git
synced 2026-07-11 17:25:31 +00:00
58e0232a31
R9-2 (extensions): UIManifestProcessor was reading
`self.app.config["APPLICATION_ROOT"]` after the master merge; callers in
`test_get_manifest_*` pass `Mock(config={})` and got a KeyError. Use
`.get(..., "")` for both STATIC_ASSETS_PREFIX and APPLICATION_ROOT so the
context processor degrades to empty-string under partial mocks. Affects
unit-tests, test-mysql, test-postgres, test-sqlite lanes.
R9-3 (dashboard_test): `test_dashboard_link_renders_plain_slug` asserts a
`/superset` prefix but `test_request_context("/")` builds a URL adapter
with empty script root, so `url_for` emitted `/dashboard/sales/`. Pass
`base_url="http://localhost/superset/"` so werkzeug derives SCRIPT_NAME
from the base URL and the adapter prepends it. environ_base alone is
insufficient — the URL adapter binds to the parsed base URL, not raw
environ.
R9-1 (navigationUtils.schemes): the redirect-scheme test asserted
byte-identity against `/superset/<scheme:body>` but `navigateTo` runs the
path through `new URL(...).pathname` then `encodeURI()` as part of the
CodeQL sanitiser triple-layer, encoding `<` -> `%3C` -> `%253C`. Replace
the byte-equality with a shape-match: assert the scheme survives only as
a prefixed path segment and the value does not start with any dangerous
scheme. The open-redirect contract is satisfied by either shape; the
encodeURI hardening is additional defence on top.
R9-4 (FilterBar.subdirectory): prettier-frontend wanted four formatting
collapses (multi-line readFileSync, double-quoted backtick-string to
single, long description unwrap, multi-line not.toMatch). Pure style.
Lockfile: the master merge added `@braintree/sanitize-url` to
superset-frontend's workspace package.json but didn't lock it. `npm ci`
on CI would fail strict-mode resolution; without it, jest in the
sharded-jest-tests #7 lane cannot resolve the import at module-load
time. Sync the lockfile entry.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>