feat(config): add EXPOSE_VERSION_INFO to control /version detail#40652
feat(config): add EXPOSE_VERSION_INFO to control /version detail#40652rusackas wants to merge 3 commits into
Conversation
dosubot
Bot
added
api
![codeant-ai-for-open-source[bot]](https://avatars.githubusercontent.com/u/151810221?s=60&v=4){kind=small}
|
The PR comment indicates a performance issue where the superset/views/health.py |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #40652 +/- ##
=======================================
Coverage 64.08% 64.08%
=======================================
Files 2663 2663
Lines 143289 143292 +3
Branches 32952 32953 +1
=======================================
+ Hits 91832 91835 +3
Misses 49871 49871
Partials 1586 1586
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![bito-code-review[bot]](https://avatars.githubusercontent.com/in/1061978?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review Agent Run #fabd4a
Actionable Suggestions - 1
-
tests/unit_tests/views/health_version_test.py - 1
- Missing build_number assertion · Line 32-51
Review Details
-
Files reviewed - 4 · Commit Range:
bde4d0a..bde4d0a- superset/config.py
- superset/views/health.py
- tests/unit_tests/config_test.py
- tests/unit_tests/views/health_version_test.py
-
Files skipped - 1
- UPDATING.md - Reason: Filter setting
-
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
Bito Usage Guide
Commands
Type the following command in the pull request comment and save the comment.
-
/review- Manually triggers a full AI review. -
/pause- Pauses automatic reviews on this pull request. -
/resume- Resumes automatic reviews. -
/resolve- Marks all Bito-posted review comments as resolved. -
/abort- Cancels all in-progress reviews.
Refer to the documentation for additional commands.
Configuration
This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.
Documentation & Help
AI Code Review powered by
There was a problem hiding this comment.
Pull request overview
Adds an operator-controlled config (EXPOSE_VERSION_INFO) to limit how much build/version metadata the unauthenticated /version endpoint exposes, while keeping the current behavior by default for backward compatibility.
Changes:
- Introduces
EXPOSE_VERSION_INFO(defaultTrue) insuperset/config.py. - Gates
/versionresponse insuperset/views/health.pyto optionally return onlyversion_string. - Adds unit tests for both behaviors and documents the new option in
UPDATING.md.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
superset/views/health.py |
Adds EXPOSE_VERSION_INFO check to redact /version response fields when disabled. |
superset/config.py |
Defines the new EXPOSE_VERSION_INFO config default and documentation comment. |
tests/unit_tests/views/health_version_test.py |
New unit tests covering full vs. redacted /version responses. |
tests/unit_tests/config_test.py |
Asserts the config default is True. |
UPDATING.md |
Documents the new config option and its effect on /version. |
Code Review Agent Run #8b792bActionable Suggestions - 0Filtered by Review RulesBito filtered these suggestions based on rules created automatically for your feedback. Manage rules.
Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
The unauthenticated /version endpoint returns the version string along with the Git SHA, full SHA, build number, and branch name when available. Add an EXPOSE_VERSION_INFO config option (default True, preserving existing behavior) that, when set to False, reduces the response to just the version string and omits the build-specific details. The gating is applied in the endpoint itself so the change is opt-in and non-breaking for existing deployments. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a conservative `Cross-Origin-Resource-Policy: same-site` default to DEFAULT_HTTP_HEADERS as a defense-in-depth response-header hardening. The header is applied through the existing DEFAULT_HTTP_HEADERS mechanism, so it is only set when a response does not already carry the header and operators can override it via config. `same-site` is used rather than the stricter `same-origin` so documented same-site embedding flows (e.g. the Embedded SDK) keep working unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tadata - Skip get_version_metadata() when the flag is False: read VERSION_STRING directly from app config so git subprocesses are never invoked on unauthenticated /version requests when version details are redacted - Add missing build_number assertion in the positive-flag test case - Update the disabled-flag test to match new code path (no longer mocks get_version_metadata; sets VERSION_STRING directly in app config) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
rusackas
force-pushed
the
fix/version-info-exposure-flag
branch
from
62556ae to
0052909
Compare
Code Review Agent Run #3c52c2Actionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
|
Closing for now... will re-assess if this is really needed. |
github-project-automation
Bot
moved this from Needs Review
to Approved and/or Merged
in Superset Review Help Wanted
SUMMARY
The unauthenticated
/versionendpoint (superset/views/health.py) returns the full version metadata:version_string,version_sha,full_sha,build_number, andbranch_name(when available, sourced fromget_version_metadata()). This PR adds anEXPOSE_VERSION_INFOconfig option so operators can control how much of that build-specific detail is exposed to unauthenticated callers — generic surface-reduction hardening.Default choice:
EXPOSE_VERSION_INFO = True, which preserves the existing behavior and is the least-breaking option. I chose to keep the current behavior by default rather than silently changing what/versionreturns; operators opt in to the reduced response. When set toFalse,/versionreturns only{"version_string": ...}and omits the Git SHA, full SHA, build number, and branch name. The gating lives in the endpoint itself.Back-compat / escape hatch: because the default is
True, existing deployments see no change. The reduced response is fully opt-in via:An
UPDATING.mdentry under## Nextdocuments the new option and notes it is non-breaking.BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
GET /versionwithEXPOSE_VERSION_INFO = True(default):{"version_string": "1.2.3", "version_sha": "abcd1234", "full_sha": "abcd1234ef567890", "build_number": "42", "branch_name": "master"}GET /versionwithEXPOSE_VERSION_INFO = False:{"version_string": "1.2.3"}TESTING INSTRUCTIONS
Unit tests added in
tests/unit_tests/views/health_version_test.py(pass locally):True) returns full metadata including SHA and branchFalsereturns onlyversion_stringand omits SHA/full SHA/build number/branchPlus a config-default assertion in
tests/unit_tests/config_test.py::test_expose_version_info_defaults_to_true.ADDITIONAL INFORMATION
🤖 Generated with Claude Code