FrancescoCastaldi commented on PR #45186:
URL: https://github.com/apache/superset/pull/45186#issuecomment-6153752678
Addressed the review feedback from @sadpandajoe (review #5508351422,
discussion r4262642522) in commit `1f01f7f`:
- **Remediation Guide & Exploitability Table**
(`docs/admin_docs/security/dependency-vulnerability-remediation.mdx`):
- Updated the GHSA-j586-36cw-2gc2 analysis to clarify that
`msgpack.loads(payload, raw=False)` in `superset/views/utils.py` uses the
default `strict_map_key=True` behavior, which can fail if map keys are not
`str` or `bytes`.
- Tied the non-exploitability reasoning to payload provenance: msgpack
query result payloads stored in the results backend are produced by internal
Celery worker execution rather than direct user input.
- Added explicit guidance recommending that operators upgrade to
`msgpack>=1.2.3` (Option A) to remediate the C-extension memory leak directly,
rather than relying on payload non-reachability.
- **Triage Guidance** (`.trivyignore` Option B):
- Updated the inline comment for GHSA-j586-36cw-2gc2 to state that
upgrading to `msgpack>=1.2.3` (Option A) is recommended over suppression
because `strict_map_key=True` is enabled by default in
`superset/views/utils.py`.
@sadpandajoe, the update is pushed and ready for re-review. Thank you for
the detailed feedback!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
