apache/superset · warning · EChartOptionsParseError

validation_error

validation_error

Error message

EChart options validation failed

What it means

RedirectView.redirect_warning (superset/views/redirect.py:63, public route /redirect/, gated on the ALERT_REPORTS feature flag) aborts 400 'Missing URL parameter' when the url query param is absent, empty, or whitespace-only after strip(). The endpoint renders the external-link warning page used in alert/report emails; without a target there is nothing to warn about.

Source

Thrown at superset-frontend/plugins/plugin-chart-echarts/src/utils/safeEChartOptionsParser.ts:161

      // For primitive properties (animation, backgroundColor, etc.), validate with full schema
      const primitiveResult =
        customEChartOptionsSchema.shape[
          key as keyof typeof customEChartOptionsSchema.shape
        ]?.safeParse(value);

      if (primitiveResult?.success) {
        result[key] = primitiveResult.data;
      } else if (primitiveResult) {
        validationErrors.push(
          `Invalid property "${key}": ${primitiveResult.error?.issues.map(e => e.message).join(', ') ?? 'Invalid value'}`,
        );
      }
      // Unknown properties are silently ignored
    }
  }

  if (validationErrors.length > 0) {
    throw new EChartOptionsParseError(
      'EChart options validation failed',
      'validation_error',
      validationErrors,
    );
  }

  return result as CustomEChartOptions;
}

// =============================================================================
// AST Safety Validation
// =============================================================================

/**
 * Safe AST node types that are allowed in EChart options.
 * These represent static data structures without executable code.
 */
const SAFE_NODE_TYPES = new Set([

View on GitHub (pinned to f4587218dd)

Solutions

1. Always include a non-blank url query parameter: GET /redirect/?url=<urlencoded target>
2. In alert/report templates, guard the link generation so no link is emitted when the target field is empty
3. For automated checks of link health, treat 400 here as 'malformed link in message', not an outage

Example fix

{# before: email template emits broken link when value empty #}
<a href="/redirect/?url={{ chart_url }}">view</a>

{# after #}
{% if chart_url %}<a href="/redirect/?url={{ chart_url | urlencode }}">view</a>{% endif %}

def redirect_url(target: str | None) -> str | None:
    if not target or not target.strip():
        return None
    return target.strip()

const hasRedirectTarget = (u: string | null | undefined): boolean =>
  typeof u === "string" && u.trim().length > 0;

When it happens

Trigger: GET /redirect/ with no ?url=, ?url=%20 (only spaces), or ?url= (empty value); also clients that URL-encode the key differently (?target=, ?u=) so request.args.get('url') returns ''.

Common situations: Email template links whose merge fields for the URL are empty for a particular alert row; manual edits to report templates dropping the url param; crawlers hitting /redirect/ bare.

Related errors

• security_error
• Please provide both time bounds (Since and Until)
• All values must be numeric
• Unsupported whisker type: ${whiskerOptions}
• Found invalid orderby options

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/d646680f840194c6. Report an issue: GitHub.