sha174n opened a new pull request, #40567:
URL: https://github.com/apache/superset/pull/40567
### SUMMARY
`DISALLOWED_SQL_FUNCTIONS` and `DISALLOWED_SQL_TABLES` are documented in
`superset/config.py` as covering "SQL Lab and Charts," but until now the only
call site that consulted them was `superset/sql_lab.py`. The chart-data
execution path (`ChartDataRestApi.data` ->
`QueryContextProcessor.get_df_payload` -> `SqlaTable.query` ->
`Database.get_df`) routed around the gate entirely. That meant denylist entries
effective on the SQL Lab side were silently inactive for the same SQL when it
came in via a Custom SQL metric on a chart.
This change ports the existing `sql_lab` gate into `ExploreMixin.query`
(`superset/models/helpers.py`), immediately after the SQL is rendered and
before it is handed to the database. Behaviour for benign queries is unchanged.
### Changes
- `superset/models/helpers.py`: import
`SupersetDisallowedSQLFunctionException` and
`SupersetDisallowedSQLTableException`. In `ExploreMixin.query`, after the
rendered SQL is available and before `self.database.get_df(...)` runs, consult
`current_app.config["DISALLOWED_SQL_FUNCTIONS"]` and
`["DISALLOWED_SQL_TABLES"]` for the active engine. Parse the rendered SQL via
`SQLScript` and raise the appropriate exception if `check_functions_present` or
`check_tables_present` matches.
### Tests
`tests/unit_tests/connectors/sqla/models_test.py`
- `test_query_blocks_disallowed_function_on_chart_data_path`: a chart-data
query referencing `version()` (with `DISALLOWED_SQL_FUNCTIONS={'postgresql':
{'version'}}`) raises `SupersetDisallowedSQLFunctionException` and never
reaches `get_df`.
- `test_query_blocks_disallowed_table_on_chart_data_path`: a chart-data
query touching `pg_authid` (with `DISALLOWED_SQL_TABLES={'postgresql':
{'pg_authid'}}`) raises `SupersetDisallowedSQLTableException`.
- `test_query_allows_benign_sql_on_chart_data_path`: negative control.
Benign SQL flows through to `get_df` unchanged.
All 32 tests in `tests/unit_tests/connectors/sqla/models_test.py` pass.
Pre-commit (ruff-format, ruff, mypy, pylint) clean.
### Testing instructions
```
pytest tests/unit_tests/connectors/sqla/models_test.py -v
```
Manual verification: with `DISALLOWED_SQL_FUNCTIONS = {"postgresql":
{"version"}}` in `superset_config.py`, create a chart with a Custom SQL metric
of `MAX(version())`. Before this change, the chart returned the PostgreSQL
version string. After this change, the chart request fails with the same error
class that SQL Lab already returned for the equivalent query.
### Additional information
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
