Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: adding feature flags to escape/hide html in markdown #11340

Merged
merged 9 commits into from
Oct 21, 2020
Merged

feat: adding feature flags to escape/hide html in markdown #11340

merged 9 commits into from
Oct 21, 2020

Conversation

rusackas
Copy link
Member

SUMMARY

Adds feature flags (set with defaults to match current behavior) that (a) can escape/display HTML code, or (b) hide the output of HTML markup.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TEST PLAN

Tested (visually, and in Chrome inspector) that HTML is escaped when ESCAPE_MARKDOWN_HTML is enabled, and that HTML is hidden when DISPLAY_MARKDOWN_HTML is turned off.

ADDITIONAL INFORMATION

  • Has associated issue:
  • Changes UI
  • Requires DB Migration.
  • Confirm DB Migration upgrade and downgrade tested.
  • Introduces new feature or API
  • Removes existing feature or API

@codecov-io
Copy link

codecov-io commented Oct 20, 2020 •
edited
Loading

Codecov Report

Merging #11340 into master will decrease coverage by 4.01%.
The diff coverage is 66.66%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master   #11340      +/-   ##
==========================================
- Coverage   65.59%   61.57%   -4.02%     
==========================================
  Files         832      838       +6     
  Lines       39448    39841     +393     
  Branches     3598     3655      +57     
==========================================
- Hits        25874    24533    -1341     
- Misses      13465    15127    +1662     
- Partials      109      181      +72
Flag Coverage Δ
#cypress ?
#javascript 62.63% <66.66%> (-0.04%) ⬇️
#python 60.94% <ø> (+0.18%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
...c/dashboard/components/gridComponents/Markdown.jsx 88.29% <0.00%> (-0.95%) ⬇️
superset/config.py 90.18% <ø> (+0.11%) ⬆️
superset-frontend/src/featureFlags.ts 88.23% <100.00%> (-11.77%) ⬇️
superset-frontend/src/SqlLab/App.jsx 0.00% <0.00%> (-100.00%) ⬇️
superset-frontend/src/explore/App.jsx 0.00% <0.00%> (-100.00%) ⬇️
superset-frontend/src/dashboard/App.jsx 0.00% <0.00%> (-100.00%) ⬇️
superset-frontend/src/explore/index.jsx 0.00% <0.00%> (-100.00%) ⬇️
superset-frontend/src/dashboard/index.jsx 0.00% <0.00%> (-100.00%) ⬇️
superset-frontend/src/setup/setupColors.js 0.00% <0.00%> (-100.00%) ⬇️
superset-frontend/src/chart/ChartContainer.jsx 0.00% <0.00%> (-100.00%) ⬇️
... and 235 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8676c3e...3e7b5ec. Read the comment docs.

villebro
villebro approved these changes Oct 21, 2020
View reviewed changes
Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, with a few minor non-blocking recommendations

superset/config.py Outdated
Comment on lines 311 to 312
"DISPLAY_MARKDOWN_HTML": True,
"ESCAPE_MARKDOWN_HTML": False,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we add comments here that explain how these affect the behaviour? Also, it could be a good idea to add a comment in UPDATING.md in case someone is currently relying on this functionality.

Copy link
Member Author

@rusackas rusackas Oct 21, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default settings in this PR mimic the current default behavior, so the feature shouldn't require any action when updating.

That said, the comments do seem valuable. I'll add 'em!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some comments... let me know if they don't make sense.

villebro
villebro approved these changes Oct 21, 2020
View reviewed changes
Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

robdiciuccio
robdiciuccio reviewed Oct 21, 2020
View reviewed changes
superset/config.py
"DISPLAY_MARKDOWN_HTML": True,

# When True, this escapes HTML (rather than rendering it) in Markdown components
"ESCAPE_MARKDOWN_HTML": False,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security-first default settings would be my preferred approach. Is there a reason why the default here can't be secure out of the box?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe there are any security issues that exist in this implementation.

The reason these flags aren't flipped here is that it would cause the example dashboards (and perhaps customer/user dashboards) to suddenly look very broken, with a bunch of noisy HTML displayed, or (in the examples) nothing displayed at all.

@rusackas rusackas merged commit 6fe7b4a into apache:master Oct 21, 2020
@rusackas rusackas deleted the sanitize-markdown branch October 21, 2020 22:07
@mistercrunch mistercrunch mentioned this pull request Oct 24, 2020
Merged
6 tasks
auxten pushed a commit to auxten/incubator-superset that referenced this pull request Nov 20, 2020
@rusackas @auxten
feat: adding feature flags to escape/hide html in markdown (apache#11340
7eeb518 
)

* utilizing feature flag for html escapement

* use src alias

* Feature flag to allow hiding of HTML tags

* strips js attr

* better feature flag naming

* simplifying

* Adding comments to new feature flags

* shorter comment, because pylint,

* pedantic change to get black to format a file
villebro pushed a commit that referenced this pull request Feb 25, 2021
@rusackas @villebro
feat: adding feature flags to escape/hide html in markdown (#11340)
caa18ce 
* utilizing feature flag for html escapement

* use src alias

* Feature flag to allow hiding of HTML tags

* strips js attr

* better feature flag naming

* simplifying

* Adding comments to new feature flags

* shorter comment, because pylint,

* pedantic change to get black to format a file
@mistercrunch mistercrunch added 🍒 0.38.1 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 1.0.0 labels Mar 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@robdiciuccio robdiciuccio robdiciuccio left review comments

@villebro villebro villebro approved these changes

@nytai nytai nytai approved these changes

@mistercrunch mistercrunch Awaiting requested review from mistercrunch

Assignees
No one assigned
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/M 🍒 0.38.1 🚢 1.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@rusackas @codecov-io @robdiciuccio @nytai @villebro @mistercrunch