apache/superset · error · DatasetForbiddenDataURI

Data URI is not allowed.

Error message

Data URI is not allowed.

What it means

validate_data_uri enforces a sandbox on the 'data' URL attached to imported datasets. For file:// URIs it rejects any authority component other than empty or 'localhost' (blocking file://remotehost/... style URIs) by raising DatasetForbiddenDataURI (a subclass of ImportFailedError). This prevents the import machinery, which may fetch the data URI, from being pointed at remote SMB/NFS-style hosts.

Source

Thrown at superset/commands/dataset/importers/v1/utils.py:145

    bundled examples folder.  All other URIs must match a pattern in
    ``DATASET_IMPORT_ALLOWED_DATA_URLS`` *and* resolve to a publicly-routable host.

    :param data_uri: the URI to validate
    :raises DatasetForbiddenDataURI: if the URI is not permitted
    """
    parsed = urlparse(data_uri)
    # ``urlparse`` lower-cases the scheme, so gating on it (rather than a
    # case-sensitive ``startswith("file://")``) also rejects mixed-case
    # variants like ``FiLe://`` that would otherwise skip the local-file
    # sandbox check below.
    if parsed.scheme == "file":
        from urllib.request import url2pathname

        from superset.examples.helpers import get_examples_folder

        # Reject non-local authority components (e.g. file://remotehost/path).
        if parsed.netloc and parsed.netloc.lower() != "localhost":
            raise DatasetForbiddenDataURI()
        # url2pathname handles URL-encoded characters and platform path separators.
        file_path = url2pathname(parsed.path)
        # Resolve symlinks and relative components before comparing.
        real_path = os.path.realpath(file_path)
        examples_folder = os.path.realpath(get_examples_folder())
        if not real_path.startswith(examples_folder + os.sep):
            raise DatasetForbiddenDataURI()
        return

    allowed_urls = app.config["DATASET_IMPORT_ALLOWED_DATA_URLS"]
    for allowed_url in allowed_urls:
        try:
            match = re.match(allowed_url, data_uri)
        except re.error:
            logger.exception(
                "Invalid regular expression on DATASET_IMPORT_ALLOWED_URLS"
            )
            raise

View on GitHub (pinned to f4587218dd)

Solutions

1. Change the URI to a local path form: file:///abs/path/file.csv (empty authority) or file://localhost/...
2. Host the data on an https URL and allowlist it via DATASET_IMPORT_ALLOWED_DATA_URLS

Example fix

# before
data: file://nas/share/sales.csv
# after
data: file:///mnt/nas/share/sales.csv  # must resolve inside the examples folder

from urllib.parse import urlparse

def is_allowed_file_uri(uri: str) -> bool:
    p = urlparse(uri)
    if p.scheme != 'file':
        return True  # not a file URI; other rules apply
    return p.netloc == '' or p.netloc.lower() == 'localhost'

def uses_local_authority(uri: str) -> bool:
    p = urlparse(uri)
    return p.scheme != 'file' or p.netloc.lower() in ('', 'localhost')

from superset.commands.dataset.exceptions import DatasetForbiddenDataURI
try:
    import_dataset(config)
except DatasetForbiddenDataURI:
    # rewrite data: file://host/... -> https URL on the allowlist, or drop the data field
    ...

When it happens

Trigger: Importing a dataset whose YAML contains data_uri: file://somehost/path/to/file.csv — a file URI with a non-localhost authority.

Common situations: Hand-crafted bundles referencing network file shares via file URI syntax; files saved by tools that emit host-qualified file URIs (e.g. some Windows or browser-export tooling).

Related errors

• security_error
• Import failed for an unknown reason
• {file_name} has no valid keys
• {file_name} is not a valid file
• ; ".join(str(message) for message in ex.messages)

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/6f20d4dd6273e980. Report an issue: GitHub.