{"record":{"id":"6f20d4dd6273e980","repo":"apache/superset","slug":"data-uri-is-not-allowed","errorCode":null,"errorMessage":"Data URI is not allowed.","messagePattern":"Data URI is not allowed\\.","errorType":"exception","errorClass":"DatasetForbiddenDataURI","httpStatus":500,"severity":"error","filePath":"superset/commands/dataset/importers/v1/utils.py","lineNumber":145,"sourceCode":"    bundled examples folder.  All other URIs must match a pattern in\n    ``DATASET_IMPORT_ALLOWED_DATA_URLS`` *and* resolve to a publicly-routable host.\n\n    :param data_uri: the URI to validate\n    :raises DatasetForbiddenDataURI: if the URI is not permitted\n    \"\"\"\n    parsed = urlparse(data_uri)\n    # ``urlparse`` lower-cases the scheme, so gating on it (rather than a\n    # case-sensitive ``startswith(\"file://\")``) also rejects mixed-case\n    # variants like ``FiLe://`` that would otherwise skip the local-file\n    # sandbox check below.\n    if parsed.scheme == \"file\":\n        from urllib.request import url2pathname\n\n        from superset.examples.helpers import get_examples_folder\n\n        # Reject non-local authority components (e.g. file://remotehost/path).\n        if parsed.netloc and parsed.netloc.lower() != \"localhost\":\n            raise DatasetForbiddenDataURI()\n        # url2pathname handles URL-encoded characters and platform path separators.\n        file_path = url2pathname(parsed.path)\n        # Resolve symlinks and relative components before comparing.\n        real_path = os.path.realpath(file_path)\n        examples_folder = os.path.realpath(get_examples_folder())\n        if not real_path.startswith(examples_folder + os.sep):\n            raise DatasetForbiddenDataURI()\n        return\n\n    allowed_urls = app.config[\"DATASET_IMPORT_ALLOWED_DATA_URLS\"]\n    for allowed_url in allowed_urls:\n        try:\n            match = re.match(allowed_url, data_uri)\n        except re.error:\n            logger.exception(\n                \"Invalid regular expression on DATASET_IMPORT_ALLOWED_URLS\"\n            )\n            raise","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/dataset/importers/v1/utils.py#L127-L163","documentation":"validate_data_uri enforces a sandbox on the 'data' URL attached to imported datasets. For file:// URIs it rejects any authority component other than empty or 'localhost' (blocking file://remotehost/... style URIs) by raising DatasetForbiddenDataURI (a subclass of ImportFailedError). This prevents the import machinery, which may fetch the data URI, from being pointed at remote SMB/NFS-style hosts.","triggerScenarios":"Importing a dataset whose YAML contains data_uri: file://somehost/path/to/file.csv — a file URI with a non-localhost authority.","commonSituations":"Hand-crafted bundles referencing network file shares via file URI syntax; files saved by tools that emit host-qualified file URIs (e.g. some Windows or browser-export tooling).","solutions":["Change the URI to a local path form: file:///abs/path/file.csv (empty authority) or file://localhost/...","Host the data on an https URL and allowlist it via DATASET_IMPORT_ALLOWED_DATA_URLS"],"exampleFix":"# before\ndata: file://nas/share/sales.csv\n# after\ndata: file:///mnt/nas/share/sales.csv  # must resolve inside the examples folder","handlingStrategy":"validation","validationCode":"from urllib.parse import urlparse\n\ndef is_allowed_file_uri(uri: str) -> bool:\n    p = urlparse(uri)\n    if p.scheme != 'file':\n        return True  # not a file URI; other rules apply\n    return p.netloc == '' or p.netloc.lower() == 'localhost'","typeGuard":"def uses_local_authority(uri: str) -> bool:\n    p = urlparse(uri)\n    return p.scheme != 'file' or p.netloc.lower() in ('', 'localhost')","tryCatchPattern":"from superset.commands.dataset.exceptions import DatasetForbiddenDataURI\ntry:\n    import_dataset(config)\nexcept DatasetForbiddenDataURI:\n    # rewrite data: file://host/... -> https URL on the allowlist, or drop the data field\n    ...","preventionTips":["Always emit file URIs with empty authority (file:///abs/path)","Never embed remote-host file URIs in bundles","Prefer https data URLs over file URIs"],"tags":["dataset-import","security","ssrf","file-uri","superset"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}