rusackas commented on code in PR #40859:
URL: https://github.com/apache/superset/pull/40859#discussion_r3376487259


##########
tests/unit_tests/charts/test_client_processing.py:
##########
@@ -2152,6 +2152,52 @@ def 
test_apply_client_processing_csv_format_simple_table():
     }
 
 
+def test_apply_client_processing_csv_format_escapes_formula_values():
+    """
+    A value starting with a formula trigger should be escaped in the CSV
+    output, consistent with the other CSV export paths.
+    """
+
+    result = {
+        "queries": [
+            {
+                "result_format": ChartDataResultFormat.CSV,
+                "data": "is_software_dev\n=SUM(1+1)\n",
+            }
+        ]
+    }
+    form_data = {
+        "datasource": "19__table",
+        "viz_type": "table",
+        "slice_id": 69,
+        "url_params": {},
+        "granularity_sqla": "time_start",
+        "time_grain_sqla": "P1D",
+        "time_range": "No filter",
+        "groupbyColumns": [],
+        "groupbyRows": [],
+        "metrics": [],
+        "metricsLayout": "COLUMNS",
+        "adhoc_filters": [],
+        "row_limit": 10000,
+        "order_desc": True,
+        "aggregateFunction": "Sum",
+        "valueFormat": "SMART_NUMBER",
+        "date_format": "smart_date",
+        "rowOrder": "key_a_to_z",
+        "colOrder": "key_a_to_z",
+        "extra_form_data": {},
+        "force": False,
+        "result_format": "csv",
+        "result_type": "results",
+    }
+
+    processed = apply_client_processing(result, form_data)
+    # the leading "=" is neutralized with a single-quote prefix
+    assert "'=SUM(1+1)" in processed["queries"][0]["data"]
+    assert "\n=SUM(1+1)" not in processed["queries"][0]["data"]

Review Comment:
   Good forward-looking catch — applied. Switched the dtype guard in 
`df_to_escaped_csv` from `column.dtype == np.dtype(object)` to 
`pd.api.types.is_string_dtype(column.dtype)`, which still matches object 
columns under the pinned pandas 2.x but also covers the `StringDtype` columns 
pandas 3.0+ will produce, so formula escaping keeps applying. The inner 
`isinstance(value, str)` guard preserves non-string cells in mixed object 
columns, and the non-default-index regression test still passes.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to