[Design]Jinja2 support in Markup Viz

[kartikshanbhag3333]

Make sure these boxes are checked before submitting your issue - thank you!

• I have checked the superset logs for python stacktraces and included it here as text if there are any.
• I have reproduced the issue with at least the latest released version of superset.
• I have checked the issue tracker for the same issue and I haven't found one similar.

Superset version

0.28.1

Expected results

Jinja2 Templating in Markup Viz

Actual results

Steps to reproduce

def query_obj(self):
    return None

def get_df(self, query_obj=None):
    return None

def get_data(self, df):
    markup_type = self.form_data.get('markup_type')
    code = self.form_data.get('code', '')
    if markup_type == 'markdown':
        code = markdown(code)
        return dict(html=code, theme_css=get_css_manifest_files('theme'))
    else:
        print(template_processor.context["current_username"]())
        return dict(
            html=jinja2.Environment().from_string(code).render(template_processor=template_processor),
            theme_css=get_css_manifest_files('theme')
        )`

The question here is, how safe is this? template_processor is object of jinja_context.BaseTemplateProcessor

[mistercrunch]

Markup viz is getting deprecated though, and you probably want jinja2.sandbox.SandboxedEnvironment

[gbrian]

Hi @mistercrunch this viz will be quite good for our project. It will give us lot of possibilities to create a rich Welcome dashboards for the user.
It will be great if we can use Jinja2 templates and query a datasource.

Using Jinja2 templates:

In my case I'm using existing BaseTemplateProcessor

from superset.jinja_context import get_template_processor

class MarkupViz(BaseViz):

    """Use html or markdown to create a free form widget"""

    viz_type = "markup"
    verbose_name = _("Markup")
    is_timeseries = False

    def query_obj(self):
        return None

    def get_df(self, query_obj=None):
        return None

    def get_code(self):
        code = self.form_data.get("code", "")
        processor = get_template_processor(self.datasource.database)
        return processor.process_template(code)

    def get_data(self, df):
        markup_type = self.form_data.get("markup_type")
        code = self.get_code()
        if markup_type == "markdown":
            code = markdown(code, extensions=['tables'])
        return dict(html=code, theme_css=get_css_manifest_files("theme"))

Let me know if this is something good/NTH in order to create a PR.

[gbrian]

Added access to data source data by just copying from TableViz implementation.
Dataset can be accessed as an array through data variable

[micimize]

Is this just a #wont-fix because the markup viz is getting deprecated, jinja2 templating is unsafe or getting deprecated, or both? What about a slice that allows for templated html/markdown with just the query results?

[zufolo441]

Thanks to your advices I was able to enable templating in markup chart. Thanks!