Copilot commented on code in PR #40863:
URL: https://github.com/apache/superset/pull/40863#discussion_r3375252573
##########
superset/viz.py:
##########
@@ -1664,7 +1673,15 @@ def get_data(self, df: pd.DataFrame) -> VizData:
from superset import db
from superset.models.slice import Slice
- slice_ids = self.form_data.get("deck_slices")
+ slice_ids = self.form_data.get("deck_slices") or []
+ max_deck_slices = current_app.config["VIZ_DECK_SLICES_MAX_LIST_SIZE"]
+ if max_deck_slices and len(slice_ids) > max_deck_slices:
Review Comment:
`deck_slices` is treated as an arbitrary sized iterable: if a client sends a
non-list value (e.g. a string), `len(slice_ids)` will apply to the wrong thing
and `Slice.id.in_(slice_ids)` will iterate characters, producing
incorrect/empty results (or DB errors). Validate that `deck_slices` is a list
before applying the size limit/query, and use `config.get(..., 0)` to avoid a
hard KeyError if the config key is missing in a custom app config.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
