(superset) branch master updated: fix(sqllab): ignore non-object template_params in format_sql instead of 500 (#44826)

[elizabeth]

This is an automated email from the ASF dual-hosted git repository.

eschutho pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git


The following commit(s) were added to refs/heads/master by this push:
     new 883e43ee2da fix(sqllab): ignore non-object template_params in 
format_sql instead of 500 (#44826)
883e43ee2da is described below

commit 883e43ee2daca50c92e83d36604f8dd12873434d
Author: Elizabeth Thompson <eschu...@gmail.com>
AuthorDate: Wed Sep 30 15:01:29 2026 -0700

    fix(sqllab): ignore non-object template_params in format_sql instead of 500 
(#44826)
    
    Co-authored-by: Claude Opus 4.6 <nore...@anthropic.com>
---
 superset/sqllab/api.py              |  7 ++++++
 tests/unit_tests/sqllab/api_test.py | 45 +++++++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)

diff --git a/superset/sqllab/api.py b/superset/sqllab/api.py
index e8f4362a711..21a49feb149 100644
--- a/superset/sqllab/api.py
+++ b/superset/sqllab/api.py
@@ -257,6 +257,13 @@ class SqlLabRestApi(BaseSupersetApi):
                                 if isinstance(template_params, str)
                                 else template_params
                             )
+                            if not isinstance(template_params, dict):
+                                logger.warning(
+                                    "template_params is not a dict: %s."
+                                    " Skipping processing",
+                                    type(template_params).__name__,
+                                )
+                                template_params = None
                             if template_params:
                                 # Check access before rendering the Jinja
                                 # template (mirrors the SQL Lab execute path).
diff --git a/tests/unit_tests/sqllab/api_test.py 
b/tests/unit_tests/sqllab/api_test.py
index fc739748e61..00517326329 100644
--- a/tests/unit_tests/sqllab/api_test.py
+++ b/tests/unit_tests/sqllab/api_test.py
@@ -20,6 +20,7 @@ import re
 from typing import Any
 from unittest.mock import MagicMock, patch
 
+import pytest
 from flask import Flask
 from pytest_mock import MockerFixture
 
@@ -108,3 +109,47 @@ def test_format_sql_checks_access_before_rendering(
     assert response.status_code == 403
     raise_for_access.assert_called_once()
     get_template_processor.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "template_params",
+    [
+        "[1, 2]",
+        "5",
+        '"abc"',
+        "true",
+        "null",
+    ],
+)
+def test_format_sql_non_dict_template_params(
+    mocker: MockerFixture,
+    client: Any,
+    full_api_access: None,
+    template_params: str,
+) -> None:
+    """Non-dict JSON template_params must not cause a 500 TypeError."""
+    database = mocker.MagicMock()
+    database.db_engine_spec.engine = "presto"
+    mocker.patch(
+        "superset.sqllab.api.DatabaseDAO.find_by_id",
+        return_value=database,
+    )
+    raise_for_access = mocker.patch(
+        "superset.sqllab.api.security_manager.raise_for_access",
+    )
+    get_template_processor = mocker.patch(
+        "superset.sqllab.api.get_template_processor",
+    )
+
+    response = client.post(
+        "/api/v1/sqllab/format_sql/",
+        json={
+            "sql": "SELECT 1",
+            "database_id": 1,
+            "template_params": template_params,
+        },
+    )
+
+    assert response.status_code == 200
+    raise_for_access.assert_not_called()
+    get_template_processor.assert_not_called()