Skip to content

Conversation

@tvst
Copy link
Contributor

@tvst tvst commented Mar 26, 2020

This PR fixes #1230

@tvst tvst requested review from arraydude and jrhone March 26, 2020 20:26
@tvst tvst requested a review from a team as a code owner March 26, 2020 20:26
@arraydude arraydude merged commit e88b8d7 into streamlit:develop Mar 26, 2020
@tvst tvst deleted the fixpreheat branch March 26, 2020 21:44
@tconkling
Copy link
Contributor

tconkling commented Mar 26, 2020

@tvst - I don't think this is a big deal, but this change means that the preheated session ID is trivially "guessable", which could potentially enable attacks where one user impersonates another's session, and, like, uploads a nasty file on their behalf or something.

(I don't think there's any real danger of this right now, but it did recently motivate us changing ReportSession.id from an incrementing integer to a uuid. Should we perhaps change it to PREHEATED_ID = "PREHEATED_ID_" + uuid.uuid4()?)

tconkling added a commit that referenced this pull request Mar 30, 2020
* develop:
  Release 0.57.1 - Fixes SessionInfo alert bug (#1270)
  Py2k Elimination (phase 2): Scrubbing all the py2/3 compatibility clauses (#1177)
  Changing selectbox filtering as case insensitive (#1269)
  Moving st_in_cache_warning from flaky to stable (#1267)
  DataFrame | Fixing column width behavior (#1258)
  Release 0.57 (#1266)
  Fix bug where script was executing twice on first run. (#1263)
  Add default hash func for regex patterns (#1232)
  Updated readme.md help people find msft installation instructions.
  MediaFileManager: fix "Content-Type" header
tconkling added a commit to tconkling/streamlit that referenced this pull request Mar 30, 2020
* feature/plugins:
  Release 0.57.1 - Fixes SessionInfo alert bug (streamlit#1270)
  Py2k Elimination (phase 2): Scrubbing all the py2/3 compatibility clauses (streamlit#1177)
  Changing selectbox filtering as case insensitive (streamlit#1269)
  Moving st_in_cache_warning from flaky to stable (streamlit#1267)
  DataFrame | Fixing column width behavior (streamlit#1258)
  Release 0.57 (streamlit#1266)
  Fix bug where script was executing twice on first run. (streamlit#1263)
  Add default hash func for regex patterns (streamlit#1232)
  Updated readme.md help people find msft installation instructions.
  MediaFileManager: fix "Content-Type" header
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

st_in_cache_warning test is not working

3 participants