A way to make flask-caching optional / use a different caching mechanism

[michalc]

Is your feature request related to a problem? Please describe.

flask-caching has a published vulnerability https://nvd.nist.gov/vuln/detail/CVE-2021-33026#vulnCurrentDescriptionTitle where access to the cache store would lead to authorised code execution in Superset. Unfortunately, a fix does not appear available at this time.

Describe the solution you'd like

A way to not use Flask caching in Superset.

Describe alternatives you've considered

Forking Superset...

Additional context

pallets-eco/flask-caching#209
apache/airflow#16541

[dpgaspar]

Hi @michalc,

This should have followed our responsible disclosure policy that is explicitly declared when you create a security issue on Github

## DO NOT REPORT SECURITY VULNERABILITIES HERE

Please report security vulnerabilities to [email protected].

In the event a community member discovers a security flaw in Superset, it is important to follow the [Apache Security Guidelines](https://www.apache.org/security/committers.html) and release a fix as quickly as possible before public disclosure. Reporting security vulnerabilities through the usual GitHub Issues channel is not ideal as it will publicize the flaw before a fix can be applied.

We follow Apache security Guidelines has stated above, so please send a copy to [email protected] and we'll followup on this there. Thank you

[michalc]

My apologies… I guess I (mis-)assumed that since the vulnerability in flask-caching is public, there was nothing remaining to disclose or report, and all discussion could be public.

[ThiefMaster]

IMHO the CVE is bogus. If someone has write access to your cache's storage, you are most likely already compromised.

[tooptoop4]

did u fix @michalc ?