superset
superset copied to clipboard
fix(frontend): allow "constructor" property in response data
SUMMARY
Fixes #23953
Allows response JSON to be parsed with a property containing the name "constructor
".
The json-bigint
module has some safety options in place to prevent prototype pollution, but it prevents the queries from loading data where the columns contain constructor
in the name/value. For example, test_constructor
and constructor
would both throw an error.
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
TESTING INSTRUCTIONS
See #23953 for example query
ADDITIONAL INFORMATION
- [x] Has associated issue: Fixes #23953
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in SIP-59)
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
Thanks for the rebase @SpencerTorres :) Running CI now and added a few reviewers. Hopefully we can get this across the finish line and close out the issue!
looks like CI was broken on master when I pulled. Updated again
Looks like master is consistently failing to run, however I did fix a new one-line lint issue related to test code added in this commit. Updated again
CI running... fingers crossed!
Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:
Project coverage is 67.39%. Comparing base (
2948abc
) to head (cee73c4
). Report is 1 commits behind head on master.
Additional details and impacted files
@@ Coverage Diff @@
## master #25407 +/- ##
=======================================
Coverage 67.39% 67.39%
=======================================
Files 1909 1909
Lines 74736 74738 +2
Branches 8326 8326
=======================================
+ Hits 50367 50369 +2
Misses 22319 22319
Partials 2050 2050
Flag | Coverage Δ | |
---|---|---|
javascript | 57.22% <100.00%> (+<0.01%) |
:arrow_up: |
Flags with carried forward coverage won't be shown. Click here to find out more.
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
Looks like CI is happy now! Re-pinging @betodealmeida @john-bodley @villebro to see if they have a moment to help with a review.
@SpencerTorres would you be able to rebase the PR? The mandatory CI workflows have changed since CI last run, causing a few of them to now be missing.
kicking off CI. Fingers crossed!