[WIP] feat: add feature flag for CSS Templates

[tshallenberger]

SUMMARY

At Yahoo, one of our security personnel flagged this feature as a potential security issue:

The application allows user's to create custom CSS templates for their Dashboards. In doing so, the attacker was able to specify CSS that performed GET requests to the superset application. External interactions were blocked by CSP and therefore reduce the severity of the attack.
Additional CSS Injections can allow arbitrary dynamic CSS to be injected into the browser under the <style> element.
Due to availability issues this feature could not be tested further. There is likely a DOM Breakout method for this as it gets inserted plaintext into the Body of the page.
CSP Bypasses can also occur which would allow for data exfiltration in the event an open redirect can be utilized.

Additionally, there was a discussion around this feature: #296

I added a feature flag (ENABLE_CSS_TEMPLATES) that will allow users to disable CSS templates. The feature remains enabled by default.

There is a flag check in the Menu builder, a @before_request() hook in front of the CssTemplates API endpoints, and flag checks in useHeaderActionsDropdownMenu.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

(In Progress)

TESTING INSTRUCTIONS

(In Progress)

ADDITIONAL INFORMATION

• Has associated issue: Disable Custom CSS Feature #29685
• Required feature flags: ENABLE_CSS_TEMPLATES
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[tshallenberger]

This is a rough first draft at this feature, doesn't have tests or screenshots yet, but I'll try to add those this week. Would definitely appreciate feedback from the team!

[korbit-ai]

Review by Korbit AI

Korbit automatically attempts to detect when you fix issues in new commits.

Category	Issue	Status
	Hard to read type annotation ▹ view	🧠 Not in scope
	Redundant Feature Flag Checks ▹ view	🧠 Not in standard
	Missing Permission Check for CSS Editor ▹ view	🧠 Not in standard
	Incorrect HTTP status code for disabled feature ▹ view	🧠 Incorrect

Files scanned

​

File Path	Reviewed
superset-frontend/packages/superset-ui-core/src/utils/featureFlags.ts	✅
superset/css_templates/api.py	✅
superset-frontend/src/dashboard/components/Header/useHeaderActionsDropdownMenu.tsx	✅
superset/initialization/init.py	✅
superset/config.py	✅

Explore our documentation to understand the languages and file types we support and the files we ignore.

Check out our docs on how you can make Korbit work best for you and your team.

Loving Korbit!? Share us on LinkedIn Reddit and X

[codecov]

Codecov Report

Attention: Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 83.04%. Comparing base (76d897e) to head (114e99e).
Report is 1926 commits behind head on master.

Files with missing lines	Patch %	Lines
superset/css_templates/api.py	88.88%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #33675       +/-   ##
===========================================
+ Coverage   60.48%   83.04%   +22.56%     
===========================================
  Files        1931      558     -1373     
  Lines       76236    40996    -35240     
  Branches     8568        0     -8568     
===========================================
- Hits        46114    34047    -12067     
+ Misses      28017     6949    -21068     
+ Partials     2105        0     -2105     

Flag	Coverage Δ
hive	47.62% <60.00%> (-1.53%)	⬇️
javascript	?
mysql	73.96% <90.00%> (?)
postgres	74.02% <90.00%> (?)
presto	51.99% <60.00%> (-1.82%)	⬇️
python	83.04% <90.00%> (+19.54%)	⬆️
sqlite	73.50% <90.00%> (?)
unit	61.62% <60.00%> (+3.99%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sadpandajoe]

Since this is a WIP still, going to convert this to a draft until it's ready.

[rusackas]

Sounds good to me! @dpgaspar may want to assess the security implications.