aminghadersohi commented on code in PR #41593:
URL: https://github.com/apache/superset/pull/41593#discussion_r3507557258
##########
superset/mcp_service/system/tool/find_users.py:
##########
@@ -64,17 +65,17 @@ async def find_users(request: FindUsersRequest, ctx:
Context) -> FindUsersRespon
)
user_model = security_manager.user_model
- needle = f"%{request.query.strip()}%"
+ needle = f"%{escape_like(request.query.strip())}%"
Review Comment:
Done — added `needle: str` annotation in the follow-up commit (`7c1edc07d7`).
##########
tests/unit_tests/mcp_service/system/tool/test_find_users.py:
##########
@@ -255,3 +255,84 @@ async def
test_list_charts_passes_changed_by_fk_filter_to_dao(mock_list, mcp_ser
forwarded_filters = mock_list.call_args.kwargs.get("column_operators")
assert forwarded_filters is not None
assert any(getattr(f, "col", None) == "changed_by_fk" for f in
forwarded_filters)
+
+
+# ---------------------------------------------------------------------------
+# LIKE wildcard escaping tests
+# ---------------------------------------------------------------------------
+
+
[email protected]
+async def test_find_users_escapes_percent_wildcard(mcp_server):
Review Comment:
Declining — the project's existing test functions in this file (and
throughout `tests/unit_tests/mcp_service/`) do not carry type annotations on
parameters or return types. Adding `-> None` only to the newly added functions
would create an inconsistency within the same file.
##########
tests/unit_tests/mcp_service/utils/test_sanitization.py:
##########
@@ -1024,3 +1024,44 @@ def
test_sanitize_sql_expression_allows_url_scheme_in_string_literal():
sanitize_sql_expression = _sanitize_sql()
expr = "COUNT(CASE WHEN url LIKE 'javascript:%' THEN 1 END)"
assert sanitize_sql_expression(expr, "sql_expression") == expr
+
+
+# ---------------------------------------------------------------------------
+# escape_like
+# ---------------------------------------------------------------------------
+
+
+def test_escape_like_plain_text():
Review Comment:
Declining — the ~100 existing test functions in `test_sanitization.py` have
no `-> None` return annotation. Adding it only to the new `escape_like` tests
would be inconsistent with the rest of the file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
