chore(docs): tighten CSP and remove external widgets by rusackas · Pull Request #36685 · apache/superset

rusackas · 2025-12-16T23:17:16Z

Summary

Tightens the Content-Security-Policy in .htaccess and removes unused external widgets to address ASF compliance concerns.

CSP Changes:

Remove unused *.run.app domain from default-src
Restrict frame-src * to frame-src 'self' calendar.google.com (only iframe is Google Calendar on community page)

README Changes:

Remove OSS Insight "Repo Activity" widget (external dependency on next.ossinsight.io)

Investigation findings for remaining CSP domains:

*.github.com - Needed for user-attachment images in docs:
- docs/developer_portal/extensions/architecture.md (2 architecture diagrams)
- docs/versioned_docs/version-6.0.0/intro.md (video)
*.googleapis.com, *.google.com, *.gstatic.com - Kept - Used by kapa.ai reCAPTCHA and Google Calendar embed

Fixes: #35845

Test Plan

Verify docs site loads correctly after deployment
Verify Google Calendar embed on community page still works
Verify kapa.ai widget still functions

🤖 Generated with Claude Code

bito-code-review

Code Review Agent Run #7062e4

Actionable Suggestions - 1

docs/static/.htaccess - 1
- Incomplete CSP for Kapa AI · Line 25-25

Review Details

Files reviewed - 1 · Commit Range: 5e7fe33..5e7fe33
- docs/static/.htaccess
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

sebbASF · 2025-12-17T09:33:18Z

Sorry, but the correct way to override the CSP is to provide a list of hostnames using the a variable definition of the form.

SetEnv CSP_PROJECT_DOMAINS "host1 host2 host3"

as described here:

https://infra.apache.org/tools/csp.html

As mentioned previously [1], the CSP itself must not be replaced.

[1] #35845 (comment)

rusackas · 2026-02-06T06:51:37Z

@sebbASF Thanks for the guidance! I've updated the .htaccess to use the correct SetEnv CSP_PROJECT_DOMAINS format as specified in https://infra.apache.org/tools/csp.html

The domains included are:

widget.kapa.ai - AI chatbot widget
https://*.googleapis.com/, https://*.google.com/, https://*.gstatic.com/ - Google Calendar embed, reCAPTCHA
https://*.github.com/, https://*.githubusercontent.com/ - GitHub user-attachment images in docs
https://*.algolia.net/, https://*.algolianet.com/ - Algolia DocSearch

Let me know if any of these need VP Data Privacy approval or if the format needs adjustment.

netlify · 2026-02-06T06:53:36Z

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	`279b219`
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6a2d7c860a3cf40008bb539e
😎 Deploy Preview	https://deploy-preview-36685--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

Updates .htaccess to use the ASF-required format for CSP overrides: - Use SetEnv CSP_PROJECT_DOMAINS instead of Header set Content-Security-Policy - Document each required domain with its purpose - Reference ASF CSP documentation Required domains: - widget.kapa.ai: AI chatbot widget - *.googleapis.com, *.google.com, *.gstatic.com: Google Calendar, reCAPTCHA - *.github.com, *.githubusercontent.com: GitHub images in docs - *.algolia.net, *.algolianet.com: Algolia DocSearch Fixes: #35845 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

sebbASF · 2026-02-06T08:53:06Z

All the CSP exclusions need to be supported by links to a document (webpage or email etc) that provides the permission.

For example, kapa.ai and algolia are documented here:

https://privacy.apache.org/faq/committers.html

Note that there are conditions on how some exceptions can be included.

Any other exceptions must have explicit permission from Privacy.
If in doubt, please ask permission.

Fixes the pre-commit trailing-whitespace failure. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

rusackas · 2026-06-13T17:14:49Z

@sebbASF Done - each domain in CSP_PROJECT_DOMAINS now has an inline comment citing its approval source (privacy.apache.org/faq/committers.html for kapa.ai/Google/Algolia, and INFRA-25701 for the GitHub user-attachment images). Let me know if any of those need a stronger reference.

bito-code-review · 2026-06-13T18:53:52Z

Code Review Agent Run #03f562

Actionable Suggestions - 0

Additional Suggestions - 2

docs/static/.htaccess - 2
- CWE-1088: Removed CSP Domain References · Line 25-32
  
  The original inline CSP header included `*.run.app` and `https://sidebar.bugherd.com` which are not present in the new `CSP_PROJECT_DOMAINS`. Verify these domains are no longer needed before merging.
- CWE-1087: Inconsistent Domain Format · Line 32-32
  
  The `widget.kapa.ai` entry lacks the `https://` scheme prefix and trailing slash that all other domains in `CSP_PROJECT_DOMAINS` have. Per Apache Infrastructure's CSP format, entries should be consistent: `https://widget.kapa.ai/`
  Code suggestion
  --- docs/static/.htaccess (line 32) --- 32: -SetEnv CSP_PROJECT_DOMAINS "widget.kapa.ai https://*.googleapis.com/ https://*.google.com/ https://*.gstatic.com/ https://*.github.com/ https://*.githubusercontent.com/ https://*.algolia.net/ https://*.algolianet.com/" 32: +SetEnv CSP_PROJECT_DOMAINS "https://widget.kapa.ai/ https://*.googleapis.com/ https://*.google.com/ https://*.gstatic.com/ https://*.github.com/ https://*.githubusercontent.com/ https://*.algolia.net/ https://*.algolianet.com/"

Review Details

Files reviewed - 1 · Commit Range: 4f9468e..279b219
- docs/static/.htaccess
Files skipped - 1
- README.md - Reason: Filter setting
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

pull-request-size Bot added the size/XS label Dec 16, 2025

github-actions Bot added the doc Namespace | Anything related to documentation label Dec 16, 2025

codeant-ai-for-open-source Bot added the size:XS This PR changes 0-9 lines, ignoring generated files label Dec 16, 2025

github-actions Bot added the preset-io label Dec 16, 2025

This comment was marked as outdated.

Sign in to view

bito-code-review Bot reviewed Dec 16, 2025

View reviewed changes

Comment thread docs/static/.htaccess Outdated

rusackas force-pushed the chore/remove-unused-csp-domain branch from 5e7fe33 to f634952 Compare December 16, 2025 23:37

rusackas changed the title ~~chore(docs): remove unused *.run.app from CSP~~ chore(docs): remove unused or unapproved CSP entries per ASF policies Dec 17, 2025

rusackas marked this pull request as draft December 17, 2025 00:16

rusackas force-pushed the chore/remove-unused-csp-domain branch from f634952 to d1eddc6 Compare December 17, 2025 00:22

pull-request-size Bot added size/S and removed size/XS labels Dec 17, 2025

rusackas changed the title ~~chore(docs): remove unused or unapproved CSP entries per ASF policies~~ chore(docs): tighten CSP and remove external widgets Dec 17, 2025

rusackas mentioned this pull request Dec 17, 2025

The Content-Security-Policy header must not be overridden #35845

Open

sadpandajoe added the review:draft label Dec 17, 2025

apache deleted a comment from codeant-ai-for-open-source Bot Feb 6, 2026

rusackas force-pushed the chore/remove-unused-csp-domain branch from d1eddc6 to b21a0be Compare February 6, 2026 06:51

rusackas force-pushed the chore/remove-unused-csp-domain branch from b21a0be to 4f9468e Compare February 6, 2026 06:53

rusackas commented May 20, 2026

View reviewed changes

Comment thread docs/static/.htaccess

rusackas added 2 commits May 20, 2026 14:07

Adding ASF references to allowed CSP modifications

e6690e5

Merge branch 'master' into chore/remove-unused-csp-domain

3fdc161

rusackas marked this pull request as ready for review June 13, 2026 15:49

rusackas and others added 2 commits June 13, 2026 08:49

Merge branch 'master' into chore/remove-unused-csp-domain

ec8e4fd

chore(docs): strip trailing whitespace in .htaccess CSP comment

279b219

Fixes the pre-commit trailing-whitespace failure. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(docs): tighten CSP and remove external widgets#36685

chore(docs): tighten CSP and remove external widgets#36685
rusackas wants to merge 5 commits into
masterfrom
chore/remove-unused-csp-domain

rusackas commented Dec 16, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

bito-code-review Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

sebbASF commented Dec 17, 2025

Uh oh!

rusackas commented Feb 6, 2026

Uh oh!

netlify Bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

sebbASF commented Feb 6, 2026

Uh oh!

Uh oh!

rusackas commented Jun 13, 2026

Uh oh!

bito-code-review Bot commented Jun 13, 2026 •

edited

Loading

Code Review Agent Run #03f562

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

rusackas commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test Plan

Uh oh!

This comment was marked as outdated.

bito-code-review Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Code Review Agent Run #7062e4

Uh oh!

Uh oh!

sebbASF commented Dec 17, 2025

Uh oh!

rusackas commented Feb 6, 2026

Uh oh!

netlify Bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for superset-docs-preview ready!

Uh oh!

sebbASF commented Feb 6, 2026

Uh oh!

Uh oh!

rusackas commented Jun 13, 2026

Uh oh!

bito-code-review Bot commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #03f562

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rusackas commented Dec 16, 2025 •

edited

Loading

bito-code-review Bot left a comment •

edited

Loading

netlify Bot commented Feb 6, 2026 •

edited

Loading

bito-code-review Bot commented Jun 13, 2026 •

edited

Loading