fix: import ZIP files that have been modified (apache#12425)

* fix: import ZIP files that have been modified

* Add unit test

superset/charts/api.py

@@ -63,7 +63,7 @@
     thumbnail_query_schema,
 )
 from superset.commands.exceptions import CommandInvalidError
-from superset.commands.importers.v1.utils import remove_root
+from superset.commands.importers.v1.utils import is_valid_config, remove_root
 from superset.constants import MODEL_API_RW_METHOD_PERMISSION_MAP, RouteMethod
 from superset.exceptions import SupersetSecurityException
 from superset.extensions import event_logger
@@ -1016,6 +1016,7 @@ def import_(self) -> Response:
             contents = {
                 remove_root(file_name): bundle.read(file_name).decode()
                 for file_name in bundle.namelist()
+                if is_valid_config(file_name)
             }
 
         passwords = (

superset/commands/importers/v1/utils.py

@@ -73,3 +73,17 @@ def load_metadata(contents: Dict[str, str]) -> Dict[str, str]:
         raise exc
 
     return metadata
+
+
+def is_valid_config(file_name: str) -> bool:
+    path = Path(file_name)
+
+    # ignore system files that might've been added to the bundle
+    if path.name.startswith(".") or path.name.startswith("_"):
+        return False
+
+    # ensure extension is YAML
+    if path.suffix.lower() not in {".yaml", ".yml"}:
+        return False
+
+    return True

tests/commands_test.py

@@ -17,10 +17,21 @@
 # pylint: disable=no-self-use
 
 from superset.commands.exceptions import CommandInvalidError
+from superset.commands.importers.v1.utils import is_valid_config
 from tests.base_tests import SupersetTestCase
 
 
 class TestCommandsExceptions(SupersetTestCase):
     def test_command_invalid_error(self):
         exception = CommandInvalidError("A test")
         assert str(exception) == "A test"
+
+
+class TestImportersV1Utils(SupersetTestCase):
+    def test_is_valid_config(self):
+        assert is_valid_config("metadata.yaml")
+        assert is_valid_config("databases/examples.yaml")
+        assert not is_valid_config(".DS_Store")
+        assert not is_valid_config(
+            "__MACOSX/chart_export_20210111T145253/databases/._examples.yaml"
+        )