Markup chart disappear in Chart list -> cannot run custom javascript

[kaitorecca]

Make sure these boxes are checked before submitting your issue - thank you!

• I have checked the superset logs for python stacktraces and included it here as text if there are any.
• I have reproduced the issue with at least the latest released version of superset.
• I have checked the issue tracker for the same issue and I haven't found one similar.

Superset version

0.29.0rc6

Expected results

Still see the markup component in Chart which can run Javascript & JQuery in HTML mode like 0.28.1

Actual results

Cannot find the Markup in Chart. In Dashboard, there is one Markdown in panel but it supported only the Markdown standard, without HTML. So I cannot run custom javascript in my dashhboard.

Steps to reproduce

Menu > Data Source > Markup Chart > ...

[ripoul]

same error here !

[mistercrunch]

Markup is getting deprecated in favor or the dashboard native markup component. Allowing javascript in markup seem like a security issue. We do have ways to allow for sandboxed JS (used in deck.gl visualizations) though, maybe that could be made possible in the context of a dash. What's your use-case for custom JS in dash?

[ripoul]

it's to execute script with some parameter by calling an url. The script is a flask view. I need an interface to set the parameters.

I find a hacky way to do that :

1. you create your marckup
2. you click on the button to use it as an iFrame and you copy the src parameter
3. you create a new iframe ; you paste the src in the src block

[kaitorecca]

This is how I leverage Markup to make the customized dashboard by javascript without need to write a new whole component

If we remove markup in new official version of 0.29, I don't know how to make the same thing work. Regards to security, the user has level of making dashboard show have responsibility to make safe javascript by their customization.

[mistercrunch]

@williaster @kristw any thoughts on this? Could we make the old Markup viz run behind a feature flag?

From my understanding it's still there, we just remove it from the list in the "explore view" so that people don't get confused.

[kaitorecca]

Thanks for your consideration.

I check the code difference between 0.28.1 and 0.29.rc7 but see a lot of refactor so I can't identify the code to turn on this features again.

I move quickly on 0.29.rc because of many issues in 0.28.1 like time-series table.

[kaitorecca]

@mistercrunch , @williaster , @kristw : Can you give some advice on how to turn on this feature? I look around for the code in explore and visualization but cannot see the differences between charts in turning on it

[williaster]

We'd rather not turn the markup chart back on, it was deprecated for a reason, namely that it makes no sense in the context of a slice, it should be a dashboard construct. Even if it was turned back on in explorer, these chart types are filtered in the edit dashboard flow, so you can't add them to dashboards either.

I also don't understand what you mean by this sentence

Regards to security, the user has level of making dashboard show have responsibility to make safe javascript by their customization.

but generally agree that custom JS is a security concern and am not sure if I fully support the sandboxed JS. I think if this type of hook is needed we should find another way to expose it. As mistercrunch pointed out, we will have chart plugins soon which you could leverage to re-enable something like this.

[graceguo-supercat]

@kaitorecca The old markup chart and new markup component are very similar. You can reuse most of old markdown syntax and just copy&paste into new markup component (in Dashboard edit mode). Here are some features new markup component support: https://rexxars.github.io/react-markdown/

[kristw]

Markup is back FYI. (only for backward compatibility, and moving towards deprecation)