iop
/
superset
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: disallow uuid package on jinja2 (#10794) 

* fix: disallow uuid package on jinja2

* update UPDATING.md

* Update UPDATING.md

Co-authored-by: Ville Brofeldt <33317356+villebro@users.noreply.github.com>

Co-authored-by: Ville Brofeldt <33317356+villebro@users.noreply.github.com>
This commit is contained in:
Daniel Vaz Gaspar 2020-09-04 16:37:14 +01:00 committed by GitHub
parent 5199423ad1
commit f6858256f4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
UPDATING.md
View File

@ -23,6 +23,8 @@ assists people when migrating to a new version.
## Next ## Next
* [10794](https://github.com/apache/incubator-superset/pull/10794): Breaking change: `uuid` python package is not supported on Jinja2 anymore, only uuid functions are exposed eg: `uuid1`, `uuid3`, `uuid4`, `uuid5`.
* [10674](https://github.com/apache/incubator-superset/pull/10674): Breaking change: PUBLIC_ROLE_LIKE_GAMMA was removed is favour of the new PUBLIC_ROLE_LIKE so it can be set it whatever role you want. * [10674](https://github.com/apache/incubator-superset/pull/10674): Breaking change: PUBLIC_ROLE_LIKE_GAMMA was removed is favour of the new PUBLIC_ROLE_LIKE so it can be set it whatever role you want.
* [10590](https://github.com/apache/incubator-superset/pull/10590): Breaking change: this PR will convert iframe chart into dashboard markdown component, and remove all `iframe`, `separator`, and `markup` slices (and support) from Superset. If you have important data in those slices, please backup manually. * [10590](https://github.com/apache/incubator-superset/pull/10590): Breaking change: this PR will convert iframe chart into dashboard markdown component, and remove all `iframe`, `separator`, and `markup` slices (and support) from Superset. If you have important data in those slices, please backup manually.

5
docs/sqllab.rst
View File

@ -73,7 +73,10 @@ Superset's Jinja context:
- ``time``: ``time`` - ``time``: ``time``
- ``datetime``: ``datetime.datetime`` - ``datetime``: ``datetime.datetime``
- ``uuid``: ``uuid`` - ``uuid1``: ``uuid1``
- ``uuid3``: ``uuid3``
- ``uuid4``: ``uuid4``
- ``uuid5``: ``uuid5``
- ``random``: ``random`` - ``random``: ``random``
- ``relativedelta``: ``dateutil.relativedelta.relativedelta`` - ``relativedelta``: ``dateutil.relativedelta.relativedelta``

5
superset/extensions.py
View File

@ -50,7 +50,10 @@ class JinjaContextManager:
"relativedelta": relativedelta, "relativedelta": relativedelta,
"time": time, "time": time,
"timedelta": timedelta, "timedelta": timedelta,
"uuid": uuid, "uuid1": uuid.uuid1,
"uuid3": uuid.uuid3,
"uuid4": uuid.uuid4,
"uuid5": uuid.uuid5,
} }
self._template_processors: Dict[str, Type["BaseTemplateProcessor"]] = {} self._template_processors: Dict[str, Type["BaseTemplateProcessor"]] = {}