betodealmeida commented on code in PR #36136: URL: https://github.com/apache/superset/pull/36136#discussion_r2539631633
########## superset/utils/sql_sanitizer.py: ########## @@ -0,0 +1,95 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +from __future__ import annotations + +from typing import Any + +import sqlglot +from sqlglot import Dialects, exp +from sqlglot.errors import ParseError + +from superset.sql.parse import SQLGLOT_DIALECTS + + +def get_sqlglot_dialect(database_backend: str) -> Any: + """Map Superset database backend name to SQLGlot dialect.""" + return SQLGLOT_DIALECTS.get(database_backend, Dialects.DIALECT) + + +def sanitize_sql_with_sqlglot( + raw_sql: str, + database_backend: str, + validate_structure: bool = True, +) -> str: + """ + Sanitize a raw SQL WHERE/HAVING clause using SQLGlot. + + Parses the SQL into an AST and regenerates it with proper + escaping for the target database dialect. + + Raises ValueError if SQL contains disallowed constructs + (subqueries, DDL/DML commands, set operations). + """ + if not raw_sql or not raw_sql.strip(): + return "" + + dialect = get_sqlglot_dialect(database_backend) + + try: + parsed = sqlglot.parse_one(raw_sql, dialect=dialect) + + if validate_structure: + _validate_sql_structure(parsed) + + return parsed.sql(dialect=dialect) + + except ParseError: + return raw_sql + except ValueError: + raise + except Exception: # pylint: disable=broad-except + return raw_sql + + +def _validate_sql_structure(parsed: exp.Expression) -> None: Review Comment: We already have logic in `superset/sql/parse.py` to check for this. ########## superset/utils/sql_sanitizer.py: ########## @@ -0,0 +1,95 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +from __future__ import annotations + +from typing import Any + +import sqlglot +from sqlglot import Dialects, exp +from sqlglot.errors import ParseError Review Comment: One of the goals of moving to `sqlglot` was consolidating all SQL parsing under a couple classes (`SQLScript` and `SQLStatements`), so that if we ever want to migrate to a different parsing library we would only have to replace those two classes. Because of that I added lint rules that prevent `sqlglot` from being imported outside of `superset/sql/`, I'm not sure why the rule is no longer triggering. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
