Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: remove unsafe-eval CSP (ENG-3437) #56

Draft
wants to merge 3 commits into
base: stacklet/integration
Choose a base branch
from
Draft

fix: remove unsafe-eval CSP (ENG-3437) #56

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6fbf474
fix: remove unsafe-eval CSP (ENG-3437)
fwereade May 26, 2024
eab7c61
try strict plotly
fwereade May 28, 2024
1dc41ae
experiment
fwereade May 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion redash/settings/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@
# for more information. E.g.:
CONTENT_SECURITY_POLICY = os.environ.get(
"REDASH_CONTENT_SECURITY_POLICY",
"default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' *.segment.com *.segment.io *.hotjar.com *.hotjar.io; connect-src 'self' *.segment.com *.segment.io *.hotjar.com *.hotjar.io wss://*.hotjar.com wss://*.hotjar.io; font-src 'self' data:; img-src 'self' http: https: data: blob:; object-src 'none'; frame-ancestors 'none'; frame-src redash.io *.segment.com *.segment.io *.hotjar.com *.hotjar.io;",
Copy link

@squidsoup squidsoup May 29, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this is the only change needed to satisfy the resolution of the pentest finding as it only mentions the header, not any calls to eval within redash - we shouldn't need to touch any of the redash libraries. I don't see any indication in the segment or hotjar docs that unsafe-eval is required.

"default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' *.segment.com *.segment.io *.hotjar.com *.hotjar.io; connect-src 'self' *.segment.com *.segment.io *.hotjar.com *.hotjar.io wss://*.hotjar.com wss://*.hotjar.io; font-src 'self' data:; img-src 'self' http: https: data: blob:; object-src 'none'; frame-ancestors 'none'; frame-src redash.io *.segment.com *.segment.io *.hotjar.com *.hotjar.io;",
)
CONTENT_SECURITY_POLICY_REPORT_URI = os.environ.get("REDASH_CONTENT_SECURITY_POLICY_REPORT_URI", "")
CONTENT_SECURITY_POLICY_REPORT_ONLY = parse_boolean(
Expand Down
6 changes: 3 additions & 3 deletions viz-lib/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@
"leaflet.markercluster": "^1.1.0",
"lodash": "^4.17.10",
"numeral": "^2.0.6",
"plotly.js": "1.58.5",
"plotly.js-strict-dist": "^2.32.0",
"react-pivottable": "^0.9.0",
"react-sortable-hoc": "^1.10.1",
"tinycolor2": "^1.4.1",
Expand All @@ -113,7 +113,7 @@
}
},
"browser": {
"fs": false,
"path": false
"fs": false,
"path": false
}
}
2 changes: 0 additions & 2 deletions viz-lib/src/visualizations/chart/Renderer/CustomPlotlyChart.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@ export default function CustomPlotlyChart({ options, data }: any) {
if (container) {
const unwatch = resizeObserver(container, () => {
// Clear existing data with blank data for succeeding codeCall adds data to existing plot.
// @ts-expect-error ts-migrate(2345) FIXME: Argument of type 'null' is not assignable to param... Remove this comment to see the full error message
Plotly.purge(container);
renderCustomChart(plotlyData.x, plotlyData.ys, container, Plotly);
});
Expand All @@ -31,7 +30,6 @@ export default function CustomPlotlyChart({ options, data }: any) {
// Cleanup when component destroyed
useEffect(() => {
if (container) {
// @ts-expect-error ts-migrate(2345) FIXME: Argument of type 'null' is not assignable to param... Remove this comment to see the full error message
return () => Plotly.purge(container);
}
}, [container]);
Expand Down
2 changes: 0 additions & 2 deletions viz-lib/src/visualizations/chart/Renderer/initChart.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,6 @@ function initPlotUpdater() {
}
return updater;
},
// @ts-expect-error ts-migrate(7023) FIXME: 'process' implicitly has return type 'any' because... Remove this comment to see the full error message
process(plotlyElement: any) {
if (actions.length > 0) {
const updates = reduce(actions, (updates, action) => merge(updates, action[0]), {});
Expand Down Expand Up @@ -154,7 +153,6 @@ export default function initChart(container: any, options: any, data: any, addit
initialized: promise.then(() => result),
setZoomEnabled: createSafeFunction((allowZoom: any) => {
const layoutUpdates = { dragmode: allowZoom ? "zoom" : false };
// @ts-expect-error ts-migrate(2345) FIXME: Argument of type '{ dragmode: string | boolean; }'... Remove this comment to see the full error message
return Plotly.relayout(container, layoutUpdates);
}),
destroy: createSafeFunction(() => {
Expand Down
4 changes: 2 additions & 2 deletions viz-lib/src/visualizations/chart/plotly/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import * as Plotly from "plotly.js";
// @ts-ignore
import * as Plotly from "plotly.js-strict-dist";

import prepareData from "./prepareData";
import prepareLayout from "./prepareLayout";
Expand All @@ -7,7 +8,6 @@ import updateAxes from "./updateAxes";
import updateChartSize from "./updateChartSize";
import { prepareCustomChartData, createCustomChartRenderer } from "./customChartUtils";

// @ts-expect-error ts-migrate(2339) FIXME: Property 'setPlotConfig' does not exist on type 't... Remove this comment to see the full error message
Plotly.setPlotConfig({
modeBarButtonsToRemove: ["sendDataToCloud"],
});
Expand Down
4 changes: 2 additions & 2 deletions viz-lib/src/visualizations/chart/plotly/prepareHeatmapData.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import { map, max, uniq, sortBy, flatten, find, findIndex } from "lodash";
import { createNumberFormatter } from "@/lib/value-format";
// @ts-expect-error ts-migrate(7016) FIXME: Could not find a declaration file for module 'plot... Remove this comment to see the full error message
import Colorscale from "plotly.js/src/components/colorscale";
// @ts-ignore
import Colorscale from "plotly.js-strict-dist";
import d3 from "d3";
import chooseTextColorForBackground from "@/lib/chooseTextColorForBackground";

Expand Down
6 changes: 3 additions & 3 deletions viz-lib/src/visualizations/chart/plotly/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
import { isUndefined } from "lodash";
import moment from "moment";
// @ts-expect-error ts-migrate(7016) FIXME: Could not find a declaration file for module 'plot... Remove this comment to see the full error message
import plotlyCleanNumber from "plotly.js/src/lib/clean_number";
// @ts-ignore
import Lib from "plotly.js-strict-dist";

export function cleanNumber(value: any) {
return isUndefined(value) ? value : plotlyCleanNumber(value);
return isUndefined(value) ? value : Lib.cleanNumber(value);
}

export function getSeriesAxis(series: any, options: any) {
Expand Down
Loading