pt
/
superset
mirror of https://github.com/apache/superset.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: Talisman configuration (#22591)

This commit is contained in:
Michael S. Molina 2023-01-05 10:37:35 -05:00 committed by GitHub
parent 037deb9a1d
commit 84177cbc75
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
superset/initialization/__init__.py
View File

@ -577,25 +577,33 @@ class SupersetAppInitializer: # pylint: disable=too-many-public-methods
# Flask-Compress
Compress(self.superset_app)
# Talisman
talisman_enabled = self.config["TALISMAN_ENABLED"]
talisman_config = self.config["TALISMAN_CONFIG"]
csp_warning = self.config["CONTENT_SECURITY_POLICY_WARNING"]
if talisman_enabled:
talisman.init_app(self.superset_app, **talisman_config)
show_csp_warning = False
if (
self.config["CONTENT_SECURITY_POLICY_WARNING"]
csp_warning
and not self.superset_app.debug
and (
not talisman_enabled
or not talisman_config
or not talisman_config.get("content_security_policy")
)
):
if self.config["TALISMAN_ENABLED"]:
talisman.init_app(self.superset_app, **self.config["TALISMAN_CONFIG"])
if not self.config["TALISMAN_CONFIG"].get("content_security_policy"):
show_csp_warning = True
else:
show_csp_warning = True
show_csp_warning = True
if show_csp_warning:
logger.warning(
"We haven't found any Content Security Policy (CSP) defined in "
"the configurations. Please make sure to configure CSP using the "
"TALISMAN_CONFIG key or any other external software. Failing to "
"configure CSP have serious security implications. Check "
"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP for more "
"TALISMAN_ENABLED and TALISMAN_CONFIG keys or any other external "
"software. Failing to configure CSP have serious security implications. "
"Check https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP for more "
"information. You can disable this warning using the "
"CONTENT_SECURITY_POLICY_WARNING key."
)