From a58b3920dbfaf89d067c1f137d741f7665a4520e Mon Sep 17 00:00:00 2001
From: Beto Dealmeida <roberto@dealmeida.net>
Date: Tue, 12 Nov 2019 11:10:36 -0800
Subject: [PATCH] Encode feature flags to JSON pessimistically (#8529)

* Encode feature flags to JSON pessimistically

* Add unit test

* Remove old imports
---
 superset/views/core.py |  6 ++++--
 tests/core_tests.py    | 20 ++++++++++++++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/superset/views/core.py b/superset/views/core.py
index 0b38fcffd..cbbd1a813 100755
--- a/superset/views/core.py
+++ b/superset/views/core.py
@@ -2962,7 +2962,9 @@ class Superset(BaseSupersetView):
         return self.render_template(
             "superset/basic.html",
             entry="welcome",
-            bootstrap_data=json.dumps(payload, default=utils.json_iso_dttm_ser),
+            bootstrap_data=json.dumps(
+                payload, default=utils.pessimistic_json_iso_dttm_ser
+            ),
         )
 
     @has_access
@@ -3001,7 +3003,7 @@ class Superset(BaseSupersetView):
         return self.render_template(
             "superset/basic.html",
             entry="sqllab",
-            bootstrap_data=json.dumps(d, default=utils.json_iso_dttm_ser),
+            bootstrap_data=json.dumps(d, default=utils.pessimistic_json_iso_dttm_ser),
         )
 
     @api
diff --git a/tests/core_tests.py b/tests/core_tests.py
index 79df5d513..1e640493d 100644
--- a/tests/core_tests.py
+++ b/tests/core_tests.py
@@ -15,6 +15,7 @@
 # specific language governing permissions and limitations
 # under the License.
 """Unit tests for Superset"""
+import cgi
 import csv
 import datetime
 import doctest
@@ -949,6 +950,25 @@ class CoreTests(SupersetTestCase):
             self.assertDictEqual(deserialized_payload, payload)
             expand_data.assert_called_once()
 
+    @mock.patch.dict("superset._feature_flags", {"FOO": lambda x: 1}, clear=True)
+    def test_feature_flag_serialization(self):
+        """
+        Functions in feature flags don't break bootstrap data serialization.
+        """
+        self.login()
+
+        encoded = json.dumps(
+            {"FOO": lambda x: 1, "super": "set"},
+            default=utils.pessimistic_json_iso_dttm_ser,
+        )
+        html = cgi.escape(encoded).replace("'", "&#39;").replace('"', "&#34;")
+
+        data = self.get_resp("/superset/sqllab")
+        self.assertTrue(html in data)
+
+        data = self.get_resp("/superset/welcome")
+        self.assertTrue(html in data)
+
 
 if __name__ == "__main__":
     unittest.main()