Skip to content

Commit

Permalink
fix: REST API CSRF exempt list (apache#25590)
Browse files Browse the repository at this point in the history
  • Loading branch information
dpgaspar authored Oct 10, 2023
1 parent 2f7d4eb commit b0d3cfb
Show file tree
Hide file tree
Showing 3 changed files with 41 additions and 1 deletion.
2 changes: 1 addition & 1 deletion superset/views/base_api.py
Original file line number Diff line number Diff line change
Expand Up @@ -251,7 +251,7 @@ class BaseSupersetApi(BaseSupersetApiMixin, BaseApi):
...


class BaseSupersetModelRestApi(ModelRestApi, BaseSupersetApiMixin):
class BaseSupersetModelRestApi(BaseSupersetApiMixin, ModelRestApi):
"""
Extends FAB's ModelResApi to implement specific superset generic functionality
"""
Expand Down
9 changes: 9 additions & 0 deletions tests/unit_tests/conftest.py
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,15 @@ def app(request: SubRequest) -> Iterator[SupersetApp]:
app.config["TESTING"] = True

# loop over extra configs passed in by tests
# and update the app config
# to override the default configs use:
#
# @pytest.mark.parametrize(
# "app",
# [{"SOME_CONFIG": "SOME_VALUE"}],
# indirect=True,
# )
# def test_some_test(app_context: None) -> None:
if request and hasattr(request, "param"):
for key, val in request.param.items():
app.config[key] = val
Expand Down
31 changes: 31 additions & 0 deletions tests/unit_tests/security/api_test.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
import pytest

from superset.extensions import csrf


@pytest.mark.parametrize(
"app",
[{"WTF_CSRF_ENABLED": True}],
indirect=True,
)
def test_csrf_not_exempt(app_context: None) -> None:
"""
Test that REST API is not exempt from CSRF.
"""
assert csrf._exempt_blueprints == {"MenuApi", "SecurityApi", "OpenApi"}

0 comments on commit b0d3cfb

Please sign in to comment.