HTML <br> tag not rendering in query results

[hf-13]

Description

When running a SQL query that includes an HTML <br> tag, Superset is not rendering the tag as expected. Instead, it's being stripped from the output.

Steps to Reproduce

1. Run the following SQL query:

SELECT 'salary<=>salary<br>test' AS result;

2. Expected result: The output should display the exact text as it appears in the query.
3. Actual result: The output is displayed as "salarysalary" on a single line, with the <br> tag and subsequent text removed.

Configuration Attempted

The following configuration has been applied in a Kubernetes deployment using Helm:

FEATURE_FLAGS = {
 'ESCAPE_MARKDOWN_HTML': False,
}
HTML_SANITIZATION = True
HTML_SANITIZATION_SCHEMA_EXTENSIONS = {
 "attributes": {
     "*": ["style", "className", "class"],
 },
 "tagNames": ["br"]
}

It all was confirmed with superset shell

from superset.app import app
print(app.config)

Additional Information

• Superset is deployed on Kubernetes using Helm.
• The issue persists even with Talisman disabled (TALISMAN_ENABLED = False).
• Various combinations of HTML sanitization settings have been tried without success.

Environment

• Superset version: 4.0.2
• Kubernetes version: 1.30
• Helm chart version: 0.12.11
• Database type: postgresql

Question

Is there a way to configure Superset to properly render HTML tags, specifically the <br> tag, in query results while maintaining security?

[dosubot[bot]]

Hey there, @hf-13! 👋 I'm here to help you out with bugs, questions, and becoming a contributor.

To configure Superset to properly render HTML tags like <br> in query results while maintaining security, you need to ensure that the <br> tag is included in the XSS filter's whitelist. You can modify the xssFilter configuration to include the <br> tag:

const xssFilter = new FilterXSS({
  whiteList: {
    ...getDefaultWhiteList(),
    br: [], // Add the <br> tag to the whitelist
    span: ['style', 'class', 'title'],
    div: ['style', 'class'],
    a: ['style', 'class', 'href', 'title', 'target'],
    img: ['style', 'class', 'src', 'alt', 'title', 'width', 'height'],
    video: [
      'autoplay',
      'controls',
      'loop',
      'preload',
      'src',
      'height',
      'width',
      'muted',
    ],
  },
  stripIgnoreTag: true,
  css: false,
});

This configuration will allow the <br> tag to be rendered in the query results while still applying the XSS filter to other potentially harmful tags ^[1].

To continue talking to Dosu, mention @dosu.