apache-airflow-providers-fab 2.0.0rc1__py3-none-any.whl → 2.0.0rc2__py3-none-any.whl

airflow/providers/fab/www/static/dist/moment.624b1f00ba723d39ce06.js.LICENSE.txt

@@ -0,0 +1,11 @@
+//! Copyright (c) JS Foundation and other contributors
+
+//! github.com/moment/moment-timezone
+
+//! license : MIT
+
+//! moment-timezone.js
+
+//! moment.js
+
+//! version : 0.5.48

airflow/providers/fab/www/static/dist/oss-licenses.json

@@ -0,0 +1,20 @@
+[
+  {
+    "name": "moment",
+    "version": "2.30.1",
+    "author": "Iskren Ivov Chernev <iskren.chernev@gmail.com> (https://github.com/ichernev)",
+    "repository": "https://github.com/moment/moment.git",
+    "source": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
+    "license": "MIT",
+    "licenseText": "Copyright (c) JS Foundation and other contributors\n\nPermission is hereby granted, free of charge, to any person\nobtaining a copy of this software and associated documentation\nfiles (the \"Software\"), to deal in the Software without\nrestriction, including without limitation the rights to use,\ncopy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the\nSoftware is furnished to do so, subject to the following\nconditions:\n\nThe above copyright notice and this permission notice shall be\nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES\nOF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\nNONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\nHOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,\nWHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING\nFROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR\nOTHER DEALINGS IN THE SOFTWARE.\n"
+  },
+  {
+    "name": "moment-timezone",
+    "version": "0.5.48",
+    "author": "Tim Wood <washwithcare@gmail.com> (http://timwoodcreates.com/)",
+    "repository": "https://github.com/moment/moment-timezone.git",
+    "source": "https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.48.tgz",
+    "license": "MIT",
+    "licenseText": "The MIT License (MIT)\n\nCopyright (c) JS Foundation and other contributors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."
+  }
+]

airflow/providers/fab/www/templates/airflow/main.html

@@ -21,7 +21,7 @@
 {% from 'airflow/_messages.html' import show_message %}
 
 {% block page_title -%}
-  Airflow - Airflow 2 plugins compatibility view
+  Airflow
 {% endblock %}
 
 {% block head_css %}
@@ -53,12 +53,15 @@
 {% endblock %}
 
 {% block messages %}
-  {% call show_message(category='warning', dismissible=false) %}
-    <p>
-      You have a plugin that is using a FAB view or Flask Blueprint, which was used for the Airflow 2 UI, and is now
-      deprecated. Please update your plugin to be compatible with the Airflow 3 UI.
-    </p>
-  {% endcall %}
+  {% include 'appbuilder/flash.html' %}
+  {% if show_plugin_message %}
+    {% call show_message(category='warning', dismissible=false) %}
+      <p>
+        You have a plugin that is using a FAB view or Flask Blueprint, which was used for the Airflow 2 UI, and is now
+        deprecated. Please update your plugin to be compatible with the Airflow 3 UI.
+      </p>
+    {% endcall %}
+  {% endif %}
 {% endblock %}
 
 {% block tail_js %}
@@ -66,10 +69,6 @@
   <script>
     // below variables are used in main.js
     // keep as var, changing to const or let breaks other code
-    var Airflow = {
-      serverTimezone: '{{ server_timezone }}',
-      defaultUITimezone: '{{ default_ui_timezone }}',
-    };
     var hostName = '{{ hostname }}';
     $('time[title]').tooltip();
   </script>

airflow/providers/fab/www/templates/airflow/traceback.html

@@ -45,12 +45,8 @@ Something bad has happened. For security reasons detailed information about the
   * only after you tried it all, and have difficulty with diagnosing and fixing the problem yourself,
     get the logs with errors, describe results of your investigation so far, and consider creating a
     <b><a href="https://github.com/apache/airflow/issues/new/choose">bug report</a></b> including this information.
-
-Python version: {{ python_version }}
-Airflow version: {{ airflow_version }}
-Node: {{ hostname }}
 -------------------------------------------------------------------------------
-{{ info }}</pre>
+        </pre>
       </div>
     </div>
   </body>

airflow/providers/fab/www/templates/appbuilder/flash.html

@@ -0,0 +1,34 @@
+{#
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied.  See the License for the
+ specific language governing permissions and limitations
+ under the License.
+#}
+
+{#-
+  Adapted from: https://github.com/dpgaspar/Flask-AppBuilder/blob/master/flask_appbuilder/templates/appbuilder/flash.html
+-#}
+<link rel="stylesheet" type="text/css" href="{{ url_for_asset('flash.css') }}">
+
+{% with messages = get_flashed_messages(with_categories=true) %}
+  {% if messages %}
+    {% for category, m in messages %}
+      {% if not (request.path == auth_manager.get_url_login() and 'access is denied' in m.lower()) %}
+      {# Don't show 'Access is Denied' alert if user is logged out and on the login page. #}
+        {{ show_message(m, category) }}
+      {% endif %}
+    {% endfor %}
+  {% endif %}
+{% endwith %}

airflow/providers/fab/www/templates/appbuilder/navbar.html

@@ -18,6 +18,7 @@
 #}
 
 {% set menu = appbuilder.menu %}
+{% set languages = appbuilder.languages %}
 
 <div class="navbar navbar-fixed-top" role="navigation" style="background-color: {{ navbar_color }};">
   <div class="container">
@@ -46,7 +47,13 @@
     </div>
     <div class="navbar-collapse collapse">
       <ul class="nav navbar-nav">
+        {%- if disable_nav_bar is not defined or not disable_nav_bar -%}
         {% include 'appbuilder/navbar_menu.html' %}
+        {%- endif -%}
+      </ul>
+      <ul class="nav navbar-nav navbar-right">
+        <li class="active">
+        {% include 'appbuilder/navbar_right.html' %}
       </ul>
     </div>
   </div>

airflow/providers/fab/www/templates/appbuilder/navbar_right.html

@@ -0,0 +1,64 @@
+{#
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied.  See the License for the
+ specific language governing permissions and limitations
+ under the License.
+#}
+
+{% macro locale_menu(languages) %}
+  {% set locale = session['locale'] %}
+  {% if not locale %}
+      {% set locale = 'en' %}
+  {% endif %}
+  <li class="dropdown">
+    <a class="dropdown-toggle" href="javascript:void(0)">
+       <div class="f16"><i class="flag {{languages[locale].get('flag')}}"></i><b class="caret"></b></div>
+    </a>
+    {% if languages.keys()|length > 1 %}
+      <ul class="dropdown-menu">
+        <li class="dropdown">
+          {% for lang in languages %}
+            {% if lang != locale %}
+              <a href="{{appbuilder.get_url_for_locale(lang)}}">
+                <div class="f16"><i class="flag {{languages[lang].get('flag')}}"></i> - {{languages[lang].get('name')}}
+              </div></a>
+            {% endif %}
+          {% endfor %}
+        </li>
+      </ul>
+    {% endif %}
+  </li>
+{% endmacro %}
+
+{# clock and timezone menu #}
+<li class="dropdown" id="timezone-dropdown">
+  <a class="dropdown-toggle" style="display:none" href="#">
+    <time id="clock" class="js-tooltip"></time>
+    <b class="caret"></b>
+  </a>
+  <ul class="dropdown-menu" id="timezone-menu">
+    <li id="timezone-utc"><a data-timezone="UTC" href="#">UTC</a></li>
+    <li id="timezone-server" style="display: none;"><a data-timezone="{{ server_timezone }}" href="#">{{ server_timezone }}</a></li>
+    <li id="timezone-local"><a href="#">Local</a></li>
+    <li id="timezone-manual" style="display: none"><a data-timezone="" href="#"></a></li>
+    <li role="separator" class="divider"></li>
+    <li>
+      <form>
+        <label for="timezone-other">Other</label>
+        <input id="timezone-other" placeholder="Select Timezone name" autocomplete="off" tabindex="-1">
+      </form>
+    </li>
+  </ul>
+</li>

airflow/providers/fab/www/utils.py

@@ -0,0 +1,272 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from flask_appbuilder.models.filters import BaseFilter
+from flask_appbuilder.models.sqla import filters as fab_sqlafilters
+from flask_appbuilder.models.sqla.filters import get_field_setup_query, set_value_to_type
+from flask_appbuilder.models.sqla.interface import SQLAInterface
+from flask_babel import lazy_gettext
+from sqlalchemy import types
+from sqlalchemy.ext.associationproxy import AssociationProxy
+
+from airflow.api_fastapi.app import get_auth_manager
+from airflow.providers.fab.www.security.permissions import (
+    ACTION_CAN_ACCESS_MENU,
+    ACTION_CAN_CREATE,
+    ACTION_CAN_DELETE,
+    ACTION_CAN_EDIT,
+    ACTION_CAN_READ,
+)
+from airflow.utils import timezone
+
+if TYPE_CHECKING:
+    from sqlalchemy.orm.session import Session
+
+    from airflow.api_fastapi.auth.managers.base_auth_manager import ResourceMethod
+    from airflow.providers.fab.auth_manager.fab_auth_manager import FabAuthManager
+
+# Convert methods to FAB action name
+_MAP_METHOD_NAME_TO_FAB_ACTION_NAME: dict[ResourceMethod, str] = {
+    "POST": ACTION_CAN_CREATE,
+    "GET": ACTION_CAN_READ,
+    "PUT": ACTION_CAN_EDIT,
+    "DELETE": ACTION_CAN_DELETE,
+    "MENU": ACTION_CAN_ACCESS_MENU,
+}
+
+
+def get_fab_auth_manager() -> FabAuthManager:
+    from airflow.providers.fab.auth_manager.fab_auth_manager import FabAuthManager
+
+    auth_manager = get_auth_manager()
+    if not isinstance(auth_manager, FabAuthManager):
+        raise RuntimeError(
+            "This functionality is only available with if FabAuthManager is configured as auth manager in the environment."
+        )
+    return auth_manager
+
+
+def get_fab_action_from_method_map():
+    """Return the map associating a method to a FAB action."""
+    return _MAP_METHOD_NAME_TO_FAB_ACTION_NAME
+
+
+def get_method_from_fab_action_map():
+    """Return the map associating a FAB action to a method."""
+    return {
+        **{v: k for k, v in _MAP_METHOD_NAME_TO_FAB_ACTION_NAME.items()},
+    }
+
+
+class UtcAwareFilterMixin:
+    """Mixin for filter for UTC time."""
+
+    def apply(self, query, value):
+        """Apply the filter."""
+        if isinstance(value, str) and not value.strip():
+            value = None
+        else:
+            value = timezone.parse(value, timezone=timezone.utc)
+
+        return super().apply(query, value)
+
+
+class FilterIsNull(BaseFilter):
+    """Is null filter."""
+
+    name = lazy_gettext("Is Null")
+    arg_name = "emp"
+
+    def apply(self, query, value):
+        query, field = get_field_setup_query(query, self.model, self.column_name)
+        value = set_value_to_type(self.datamodel, self.column_name, None)
+        return query.filter(field == value)
+
+
+class FilterIsNotNull(BaseFilter):
+    """Is not null filter."""
+
+    name = lazy_gettext("Is not Null")
+    arg_name = "nemp"
+
+    def apply(self, query, value):
+        query, field = get_field_setup_query(query, self.model, self.column_name)
+        value = set_value_to_type(self.datamodel, self.column_name, None)
+        return query.filter(field != value)
+
+
+class FilterGreaterOrEqual(BaseFilter):
+    """Greater than or Equal filter."""
+
+    name = lazy_gettext("Greater than or Equal")
+    arg_name = "gte"
+
+    def apply(self, query, value):
+        query, field = get_field_setup_query(query, self.model, self.column_name)
+        value = set_value_to_type(self.datamodel, self.column_name, value)
+
+        if value is None:
+            return query
+
+        return query.filter(field >= value)
+
+
+class FilterSmallerOrEqual(BaseFilter):
+    """Smaller than or Equal filter."""
+
+    name = lazy_gettext("Smaller than or Equal")
+    arg_name = "lte"
+
+    def apply(self, query, value):
+        query, field = get_field_setup_query(query, self.model, self.column_name)
+        value = set_value_to_type(self.datamodel, self.column_name, value)
+
+        if value is None:
+            return query
+
+        return query.filter(field <= value)
+
+
+class UtcAwareFilterSmallerOrEqual(UtcAwareFilterMixin, FilterSmallerOrEqual):
+    """Smaller than or Equal filter for UTC time."""
+
+
+class UtcAwareFilterGreaterOrEqual(UtcAwareFilterMixin, FilterGreaterOrEqual):
+    """Greater than or Equal filter for UTC time."""
+
+
+class UtcAwareFilterEqual(UtcAwareFilterMixin, fab_sqlafilters.FilterEqual):
+    """Equality filter for UTC time."""
+
+
+class UtcAwareFilterGreater(UtcAwareFilterMixin, fab_sqlafilters.FilterGreater):
+    """Greater Than filter for UTC time."""
+
+
+class UtcAwareFilterSmaller(UtcAwareFilterMixin, fab_sqlafilters.FilterSmaller):
+    """Smaller Than filter for UTC time."""
+
+
+class UtcAwareFilterNotEqual(UtcAwareFilterMixin, fab_sqlafilters.FilterNotEqual):
+    """Not Equal To filter for UTC time."""
+
+
+class AirflowFilterConverter(fab_sqlafilters.SQLAFilterConverter):
+    """Retrieve conversion tables for Airflow-specific filters."""
+
+    conversion_table = (
+        (
+            "is_utcdatetime",
+            [
+                UtcAwareFilterEqual,
+                UtcAwareFilterGreater,
+                UtcAwareFilterSmaller,
+                UtcAwareFilterNotEqual,
+                UtcAwareFilterSmallerOrEqual,
+                UtcAwareFilterGreaterOrEqual,
+            ],
+        ),
+        # FAB will try to create filters for extendedjson fields even though we
+        # exclude them from all UI, so we add this here to make it ignore them.
+        ("is_extendedjson", []),
+        ("is_json", []),
+        *fab_sqlafilters.SQLAFilterConverter.conversion_table,
+    )
+
+    def __init__(self, datamodel):
+        super().__init__(datamodel)
+
+        for _, filters in self.conversion_table:
+            if FilterIsNull not in filters:
+                filters.append(FilterIsNull)
+            if FilterIsNotNull not in filters:
+                filters.append(FilterIsNotNull)
+
+
+class CustomSQLAInterface(SQLAInterface):
+    """
+    FAB does not know how to handle columns with leading underscores because they are not supported by WTForm.
+
+    This hack will remove the leading '_' from the key to lookup the column names.
+    """
+
+    def __init__(self, obj, session: Session | None = None):
+        super().__init__(obj, session=session)
+
+        def clean_column_names():
+            if self.list_properties:
+                self.list_properties = {k.lstrip("_"): v for k, v in self.list_properties.items()}
+            if self.list_columns:
+                self.list_columns = {k.lstrip("_"): v for k, v in self.list_columns.items()}
+
+        clean_column_names()
+        # Support for AssociationProxy in search and list columns
+        for obj_attr, desc in self.obj.__mapper__.all_orm_descriptors.items():
+            if isinstance(desc, AssociationProxy):
+                proxy_instance = getattr(self.obj, obj_attr)
+                if hasattr(proxy_instance.remote_attr.prop, "columns"):
+                    self.list_columns[obj_attr] = proxy_instance.remote_attr.prop.columns[0]
+                    self.list_properties[obj_attr] = proxy_instance.remote_attr.prop
+
+    def is_utcdatetime(self, col_name):
+        """Check if the datetime is a UTC one."""
+        from airflow.utils.sqlalchemy import UtcDateTime
+
+        if col_name in self.list_columns:
+            obj = self.list_columns[col_name].type
+            return (
+                isinstance(obj, UtcDateTime)
+                or isinstance(obj, types.TypeDecorator)
+                and isinstance(obj.impl, UtcDateTime)
+            )
+        return False
+
+    def is_extendedjson(self, col_name):
+        """Check if it is a special extended JSON type."""
+        from airflow.utils.sqlalchemy import ExtendedJSON
+
+        if col_name in self.list_columns:
+            obj = self.list_columns[col_name].type
+            return (
+                isinstance(obj, ExtendedJSON)
+                or isinstance(obj, types.TypeDecorator)
+                and isinstance(obj.impl, ExtendedJSON)
+            )
+        return False
+
+    def is_json(self, col_name):
+        """Check if it is a JSON type."""
+        from sqlalchemy import JSON
+
+        if col_name in self.list_columns:
+            obj = self.list_columns[col_name].type
+            return (
+                isinstance(obj, JSON) or isinstance(obj, types.TypeDecorator) and isinstance(obj.impl, JSON)
+            )
+        return False
+
+    def get_col_default(self, col_name: str) -> Any:
+        if col_name not in self.list_columns:
+            # Handle AssociationProxy etc, or anything that isn't a "real" column
+            return None
+        return super().get_col_default(col_name)
+
+    filter_converter_class = AirflowFilterConverter

airflow/providers/fab/www/views.py

@@ -0,0 +1,129 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+from urllib.parse import unquote, urljoin, urlsplit
+
+from flask import (
+    g,
+    make_response,
+    redirect,
+    render_template,
+    request,
+    url_for,
+)
+from flask_appbuilder import IndexView, expose
+
+from airflow.api_fastapi.app import get_auth_manager
+from airflow.api_fastapi.auth.managers.base_auth_manager import COOKIE_NAME_JWT_TOKEN
+from airflow.configuration import conf
+
+# Following the release of https://github.com/python/cpython/issues/102153 in Python 3.9.17 on
+# June 6, 2023, we are adding extra sanitization of the urls passed to get_safe_url method to make it works
+# the same way regardless if the user uses latest Python patchlevel versions or not. This also follows
+# a recommended solution by the Python core team.
+#
+# From: https://github.com/python/cpython/commit/d28bafa2d3e424b6fdcfd7ae7cde8e71d7177369
+#
+#   We recommend that users of these APIs where the values may be used anywhere
+#   with security implications code defensively. Do some verification within your
+#   code before trusting a returned component part.  Does that ``scheme`` make
+#   sense?  Is that a sensible ``path``?  Is there anything strange about that
+#   ``hostname``?  etc.
+#
+# C0 control and space to be stripped per WHATWG spec.
+# == "".join([chr(i) for i in range(0, 0x20 + 1)])
+_WHATWG_C0_CONTROL_OR_SPACE = (
+    "\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c"
+    "\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f "
+)
+
+
+class FabIndexView(IndexView):
+    """
+    A simple view that inherits from FAB index view.
+
+    The only goal of this view is to redirect the user to the Airflow 3 UI index page if the user is
+    authenticated. It is impossible to redirect the user directly to the Airflow 3 UI index page before
+    redirecting them to this page because FAB itself defines the logic redirection and does not allow external
+    redirect.
+    """
+
+    @expose("/")
+    def index(self):
+        if g.user is not None and g.user.is_authenticated:
+            token = get_auth_manager().generate_jwt(g.user)
+            response = make_response(redirect(f"{conf.get('api', 'base_url')}", code=302))
+
+            secure = conf.has_option("api", "ssl_cert")
+            response.set_cookie(COOKIE_NAME_JWT_TOKEN, token, secure=secure)
+
+            return response
+        else:
+            return redirect(conf.get("api", "base_url"), code=302)
+
+
+def show_traceback(error):
+    """Show Traceback for a given error."""
+    return render_template("airflow/traceback.html"), 500
+
+
+def not_found(error):
+    """Show Not Found on screen for any error in the Webserver."""
+    return (
+        render_template(
+            "airflow/error.html",
+            hostname="",
+            status_code=404,
+            error_message="Page cannot be found.",
+        ),
+        404,
+    )
+
+
+def get_safe_url(url):
+    """Given a user-supplied URL, ensure it points to our web server."""
+    if not url:
+        return url_for("FabIndexView.index")
+
+    # If the url contains semicolon, redirect it to homepage to avoid
+    # potential XSS. (Similar to https://github.com/python/cpython/pull/24297/files (bpo-42967))
+    if ";" in unquote(url):
+        return url_for("FabIndexView.index")
+
+    url = url.lstrip(_WHATWG_C0_CONTROL_OR_SPACE)
+
+    host_url = urlsplit(request.host_url)
+    redirect_url = urlsplit(urljoin(request.host_url, url))
+    if not (redirect_url.scheme in ("http", "https") and host_url.netloc == redirect_url.netloc):
+        return url_for("FabIndexView.index")
+
+    # This will ensure we only redirect to the right scheme/netloc
+    return redirect_url.geturl()
+
+
+def method_not_allowed(error):
+    """Show Method Not Allowed on screen for any error in the Webserver."""
+    return (
+        render_template(
+            "airflow/error.html",
+            status_code=405,
+            error_message="Received an invalid request.",
+        ),
+        405,
+    )