Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Adds a Content Security Policy (CSP) check for production environments #21874

Merged
merged 3 commits into from
Oct 20, 2022

Conversation

michael-s-molina
Copy link
Member

SUMMARY

Adds a Content Security Policy (CSP) check for production environments that verifies if a policy is defined or otherwise issues a warning. For deployments that manage CSP with other software, this check can be disabled using the CONTENT_SECURITY_POLICY_WARNING configuration.

TESTING INSTRUCTIONS

Check if the warning is correctly emitted or skipped.

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@codecov
Copy link

codecov bot commented Oct 19, 2022

Codecov Report

Merging #21874 (a9cf42e) into master (383dc29) will decrease coverage by 0.00%.
The diff coverage is 70.00%.

@@            Coverage Diff             @@
##           master   #21874      +/-   ##
==========================================
- Coverage   66.93%   66.92%   -0.01%     
==========================================
  Files        1805     1805              
  Lines       69066    69076      +10     
  Branches     7369     7369              
==========================================
+ Hits        46227    46232       +5     
- Misses      20932    20937       +5     
  Partials     1907     1907              
Flag Coverage Δ
hive 52.92% <70.00%> (+<0.01%) ⬆️
mysql 78.35% <70.00%> (+<0.01%) ⬆️
postgres 78.40% <70.00%> (-0.01%) ⬇️
presto 52.82% <70.00%> (+<0.01%) ⬆️
python 81.46% <70.00%> (-0.01%) ⬇️
sqlite 76.89% <70.00%> (-0.01%) ⬇️
unit 51.07% <70.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
superset/initialization/__init__.py 91.00% <66.66%> (-0.47%) ⬇️
superset/config.py 91.66% <100.00%> (+0.02%) ⬆️
superset/reports/commands/log_prune.py 85.71% <0.00%> (-3.58%) ⬇️
superset/commands/importers/v1/utils.py 92.20% <0.00%> (-1.30%) ⬇️
superset/common/query_object.py 93.87% <0.00%> (-0.52%) ⬇️
superset/datasets/commands/create.py 100.00% <0.00%> (ø)
superset/datasets/schemas.py 97.40% <0.00%> (+0.01%) ⬆️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I didn't check, but is this mentioned in the docs somewhere? If not, it would be great to make this more accessible for the greater public.

@pull-request-size pull-request-size bot added size/M and removed size/S labels Oct 19, 2022
@michael-s-molina
Copy link
Member Author

LGTM. I didn't check, but is this mentioned in the docs somewhere? If not, it would be great to make this more accessible for the greater public.

@villebro I added a section to the Security docs.

Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Restamping this, thanks for adding these great docs!

@michael-s-molina michael-s-molina merged commit f4da74c into apache:master Oct 20, 2022
AAfghahi pushed a commit that referenced this pull request Nov 1, 2022
eschutho pushed a commit that referenced this pull request Nov 2, 2022
AAfghahi pushed a commit that referenced this pull request Nov 18, 2022
AAfghahi pushed a commit that referenced this pull request Dec 15, 2022
michael-s-molina added a commit that referenced this pull request Jan 5, 2023
@mistercrunch mistercrunch added 🍒 1.5.3 🍒 2.0.1 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 2.1.0 and removed 🚢 2.1.3 labels Mar 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/M v1.5 v2.0 v2.0.1 🍒 1.5.3 🍒 2.0.1 🚢 2.1.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants