bito-code-review[bot] commented on PR #43389:
URL: https://github.com/apache/superset/pull/43389#issuecomment-5372391942
<!-- Bito Reply -->
The flagged issue is correct. The regression test for unterminated script
tags currently only verifies the removal of the `script` tag itself, which is
insufficient because the payload (e.g., `alert('xss')`) could remain in the
output. To resolve this, update the test assertion to verify that the payload
is also removed, ensuring the sanitizer is fully effective.
To implement this, update the test case in
`tests/unit_tests/utils/test_core.py` to include an assertion that checks for
the absence of the malicious payload string in the sanitized output, similar to
how the paired-script test is implemented.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
