fix: added parser to parse request referer url for url_param (issue_id : 13315)

superset/jinja_context.py

@@ -19,6 +19,7 @@
 import re
 from functools import partial
 from typing import Any, Callable, cast, Dict, List, Optional, Tuple, TYPE_CHECKING
+from urllib import parse
 
 from flask import current_app, g, request
 from flask_babel import gettext as _
@@ -201,14 +202,21 @@ def url_param(
         :param add_to_cache_keys: Whether the value should be included in the cache key
         :returns: The URL parameters
         """
-
         from superset.views.utils import get_form_data
 
         if request.args.get(param):
             return request.args.get(param, default)
         form_data, _ = get_form_data()
         url_params = form_data.get("url_params") or {}
+
+        if request.headers.get("Referer", None):
+            referer_query_param = dict(
+                parse.parse_qsl(parse.urlsplit(request.headers["Referer"]).query)
+            )
+            url_params.update(referer_query_param)
+
         result = url_params.get(param, default)
+
         if add_to_cache_keys:
             self.cache_key_wrapper(result)
         return result

tests/jinja_context_tests.py

@@ -110,6 +110,12 @@ def test_url_param_form_data(self) -> None:
         ):
             self.assertEqual(ExtraCache().url_param("foo"), "bar")
 
+    def test_referer_url_param_query(self) -> None:
+        with app.test_request_context(
+            environ_base={"HTTP_REFERER": "http://test.com?foo=bar"}
+        ):
+            self.assertEqual(ExtraCache().url_param("foo"), "bar")
+
     def test_safe_proxy_primitive(self) -> None:
         def func(input: Any) -> Any:
             return input