mikebridge opened a new pull request, #41653: URL: https://github.com/apache/superset/pull/41653
### SUMMARY The DAO column-operator filter payload (`ColumnOperator.value`) is typed `Any`, so non-string JSON values can reach the LIKE-family operators (`sw`/`ew`/`ct`/`like`/`ilike`) in `superset/daos/base.py`. Two failure modes exist on master: - A **non-string scalar** (e.g. a numeric JSON value) raises `AttributeError` inside `_escape_like` (`int` has no `.replace`) and surfaces as a 500. - The tempting fix — coercing `None` to `""` — is worse: the surrounding wildcards build a pattern like `%%` that **silently matches every row**, turning a null-valued "contains" filter into a match-all. (Not a security issue — these operators run after `base_filter` RBAC scoping — but a correctness trap: misleading results instead of an error.) This PR replaces the five duplicated LIKE lambdas with a small `_like_op` factory: - **`None` matches no rows** (`false()`), mirroring SQL three-valued logic where `x LIKE NULL` evaluates to `NULL`. - **Other scalars coerce to `str`** for a literal, wildcard-escaped match (`123` → `'%123%'`). - Wildcard escaping (`%`, `_`, `\`) is unchanged. Extracted from #40130 per review feedback (the hardening is unrelated to soft delete); the equivalent change there is being reverted in favour of this standalone fix. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A ### TESTING INSTRUCTIONS ```bash pytest tests/unit_tests/dao/base_dao_test.py -q ``` New tests pin all three behaviours across the LIKE family: `None` → compiles to a no-match clause with **no wildcard pattern**; numeric value → literal match; `%`/`_` in user input → escaped. The `None` test reproduces the `AttributeError` against master's code (verified by running it with the fix reverted). ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
