dpgaspar commented on code in PR #28639:
URL: https://github.com/apache/superset/pull/28639#discussion_r1611289082
##########
superset/config.py:
##########
@@ -1225,6 +1225,15 @@ def CSV_TO_HIVE_UPLOAD_DIRECTORY_FUNC( # pylint:
disable=invalid-name
#
DB_SQLA_URI_VALIDATOR: Callable[[URL], None] | None = None
+# A set of disallowed SQL functions per engine. This is used to restrict the
use of
+# unsafe SQL functions in SQL Lab and Charts. The keys of the dictionary are
the engine
+# names, and the values are sets of disallowed functions.
+DISALLOWED_SQL_FUNCTIONS: dict[str, set[str]] = {
Review Comment:
JSON payload at the database level is more dynamic and would avoid having to
change the config to add remove disallowed functions. But on the other hand the
user that actually registers the db could have intentions to "abuse" these
functions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
