Talisman Config not updated from superset_config.py

not1q84-1 commented 1 year ago

When setting content-security-policy options through the superset_config file these are not accepted during startup

I am running superset from scratch (3.0.0. installed via pipenv from pypi) und python3.10. my superset config file as dev environment

How to reproduce the bug

Go to superset_config and amend / change the talisman content-security policy with 3rd party websites like (I copied this also under TALISMAN_DEV_CONFIG):

TALISMAN_CONFIG = {
"content_security_policy": {
    "default-src": ["'self'"],
    "frame-src": ["'self'", "https://service.xxxx.com"]
    "img-src": ["'self'", "data:", "https://service.xxxx.com"],
    "worker-src": ["'self'", "blob:"],
    "connect-src": [
        "'self'",
        "https://api.mapbox.com",
        "https://events.mapbox.com",
    ],
    "object-src": "'none'",
    "style-src": [
        "'self'",
        "'unsafe-inline'",
        "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css",
    ],
    "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
},
"content_security_policy_nonce_in": ["script-src"],
"force_https": False,```

Start superset
Create markdown chart with img-src / frame-src pointing to third party website

 <center>
    <img width = 20px style="padding-bottom:5px;padding-top:10px" src="data:image/png;base64....">
    </br>
    <img height = 70px src="https://service.xxxx.com/icons/Pfeil_oben_links.svg">
    <p style="font-size: 35px;font-weight:bold;padding-top:0px;padding-bottom:00px">-</p>
 </center>

Load page
Links are NOT loaded and browser console shows (directive in error message does NOTinclude changes to content-security-policy):
```
Refused to load the image '<URL>' because it violates the following Content Security Policy directive: "img-src 'self' data:".
```
However changing the config.py code directly can be used as a workaround:
1. change the superset/config.py file directly in the package directory.
2. Repeat steps 2 & 4 with fully refreshing browser - content is loaded

Expected results

content-security-policy should be read from the superset_config.py file and b e considered during startup

Actual results

settings are ignored and can only be changed in superset source code directly

Screenshots

If applicable, add screenshots to help explain your problem.

Environment

browser type and version: Edge Version 117.0.2045.60 (64-Bit)
superset version: 3.0.0
python version: 3.10.13
node.js version: node not installed
any feature flags active:

Checklist

Make sure to follow these steps before submitting your issue - thank you!

[ x] I have checked the superset logs for python stacktraces and included it here as text if there are any.
[ x] I have reproduced the issue with at least the latest released version of superset.
[ x] I have checked the issue tracker for the same issue and I haven't found one similar.

Additional context

Add any other context about the problem here.

suryag1988 commented 1 year ago

Even I face the same problem... Unable to load image file in Superset 3 dashboard.

basarix commented 1 year ago

Same here, but with the added bonus that including the TALISMAN_CONFIG block into my superset_config.py file (running a docker instalation of 3.0.1), makes superset crash on boot with a load of python errors.

vglukhik commented 8 months ago

same here. Version 3.1.0

UPD. Resolved

rusackas commented 8 months ago

TALISMAN_CONFIG is in there by default now, so it shouldn't be crashing (we would hear a LOT about that). You should be able to set img-src to be 'self' data: <URL> and it should work. Closing this since it's a config issue rather than a bug, but happy to revisit if needed.

fzhan commented 6 months ago

@rusackas could you please kindly point to the manual where 'content_security_policy' and other TALISMAN_CONFIG kvs can be set using helm? I've got nowhere.

Thanks,

rusackas commented 6 months ago

I don't know if there is such a guide, actually. I also don't use Helm (I live in a luxurious world where @craig-rueda and @dpgaspar do the infra magic for Preset), but maybe @villebro or @nytai can suggest something. If this does get resolved, we'd love to see the addition of more details in the documentation if you're up for it (cc @sfirke).

sfirke commented 6 months ago

In general for every deployment method it would be nice if we added both instructions specific to that method for where to put superset_config.py (I have a PR open to make this clearer for PyPI) and a troubleshooting step for users trying to verify that file is getting picked up.

I have sometimes advised people to enable a feature flag, then look to see if that corresponding functionality is enabled in the application. But we can do better and this comes up a lot.