rusackas opened a new pull request, #41468:
URL: https://github.com/apache/superset/pull/41468
### SUMMARY
Adds a **first-class `IFRAME` dashboard component** plus a **runtime,
permission-gated Content Security Policy (CSP) allowlist**, so trusted Admins
can embed external content in dashboards and "punch holes" in the CSP at
runtime — without editing `TALISMAN_CONFIG` and restarting every Superset
process.
This is a **draft** opened for design discussion. A companion **`SIP.md`**
(following the SIP issue template) is included in the diff and tracks the
design; it will be kept in sync as the implementation evolves.
**How it works**
Superset's default CSP declares `default-src 'self'` and no `frame-src`, so
external iframes are blocked. Rather than reconfigure flask-talisman at
runtime, this adds an `after_request` hook registered **before** Talisman — so,
because Flask runs `after_request` callbacks in reverse order, it runs
**after** Talisman sets the header — that merges operator-curated allowlist
origins into the response CSP header. Entries live in a new `csp_allowlist`
table and are cached in-process with a short TTL (invalidated on write).
The whole runtime-override path is **inert unless the
`CSP_RUNTIME_ALLOWLIST` feature flag is on** (default off), so the static
deploy-time policy remains the default and operators opt in explicitly.
**Design decisions (resolved):** global allowlist scope; feature-flag
kill-switch so operators retain full control. See `SIP.md` for rationale and
rejected alternatives.
**Security posture:** off by default; write permission is Admin-only
(`CSPAllowlist` in `ADMIN_ONLY_VIEW_MENUS`); strict server-side origin
validation (bare `scheme://host[:port]`, no wildcards/paths/credentials); only
a fixed set of directives may be widened — notably **not** `script-src`;
iframes are sandboxed; audit trail via the audit mixin.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
_To add — UI is feature-flagged behind `CSP_RUNTIME_ALLOWLIST`._
### TESTING INSTRUCTIONS
1. Enable the feature flag: `FEATURE_FLAGS = {"CSP_RUNTIME_ALLOWLIST":
True}` and run the DB migration (`superset db upgrade`).
2. As an Admin, edit a dashboard → drag the new **Embed / Iframe** element
from the Layout elements pane → paste an external URL (e.g.
`https://example.com`).
3. Observe the **"This domain is not allowed to be embedded"** warning and
the **Enable domain in CSP** button. Click it.
4. The origin is added to the allowlist; the iframe now loads without a
server restart. Confirm the response `Content-Security-Policy` header now
includes `frame-src 'self' https://example.com`.
5. As a Gamma user, confirm the Enable button is absent (ask-admin text
instead) and `POST /api/v1/csp_allowlist/` is rejected.
Automated: `pytest tests/unit_tests/security/csp_test.py`
(validation/merge/hook), `tests/integration_tests/csp_allowlist/api_tests.py`
(API + permission gating), and `npx jest
src/dashboard/util/cspAllowlist.test.ts
src/dashboard/components/gridComponents/Iframe` (util + component).
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [x] Required feature flags: **`CSP_RUNTIME_ALLOWLIST`**
- [x] Changes UI
- [x] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [x] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
