codeant-ai-for-open-source[bot] commented on code in PR #40180:
URL: https://github.com/apache/superset/pull/40180#discussion_r3564759720
##########
superset-frontend/plugins/plugin-chart-table/src/TableChart.tsx:
##########
@@ -108,6 +108,25 @@ interface TableSize {
height: number;
}
+const getCrossFilterValue = (
+ value: DataRecordValue,
+ column: DataColumnMeta | undefined,
+): DataRecordValue => {
+ const input = value instanceof DateWithFormatter ? value.input : value;
+ if (
+ column?.dataType === GenericDataType.Temporal &&
+ typeof input === 'string' &&
+ input.trim() !== '' &&
+ Number.isFinite(Number(input))
+ ) {
+ return Number(input);
+ }
+ if (value instanceof Date) {
+ return value.getTime();
+ }
Review Comment:
**Suggestion:** The new Date coercion converts every
`Date`/`DateWithFormatter` filter value to epoch milliseconds, not just
numeric-string epochs. Because all temporal cells are wrapped as
`DateWithFormatter`, non-epoch temporal values (for example ISO strings) now
get rewritten to numbers, which changes filter semantics and can break backends
that expect the original temporal literal. Restrict this conversion to true
epoch-like inputs (or use `DateWithFormatter.input` for non-numeric values)
instead of coercing all `Date` instances. [incorrect condition logic]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Table chart cross-filter misformats temporal filter values.
- ❌ Cross-filtered temporal queries may fail on strict engines.
- ⚠️ Receiving charts apply filters on unintended timestamps.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Render a table chart with cross-filtering enabled so `emitCrossFilters`
is true
(`superset-frontend/plugins/plugin-chart-table/src/TableChart.tsx:422-430`
where
`emitCrossFilters` is read from props and used).
2. Use a dataset whose temporal column contains a non-epoch timestamp string
such as
`"2024-01-01T00:00:00Z`; this value is wrapped in a `DateWithFormatter`
instance for
display (`DateWithFormatter` extending `Date` and storing `input` at
`src/utils/DateWithFormatter.ts:29-47`, and temporal cell handling at
`TableChart.tsx:156-159` and null checks at `252-254`).
3. Click on a temporal cell to emit a cross-filter; the cell click handler
builds
`cellProps.onClick` and calls `toggleFilter(key, value)` with the
`DateWithFormatter`
value (`TableChart.tsx:221-235`), and `toggleFilter`
(`TableChart.tsx:598-605`) forwards
this into `getCrossFilterDataMask(key, val)`.
4. Inside `getCrossFilterDataMask`, the IN-clause for
`extraFormData.filters` is built via
`val: val.map(el => getCrossFilterValue(el!, column))`
(`TableChart.tsx:35-53 in the
520-639 block). For a `DateWithFormatter` whose `input` is a non-numeric
string, the
numeric-string branch in `getCrossFilterValue` (`TableChart.tsx:115-123`)
fails, and
execution falls through to `if (value instanceof Date) { return
value.getTime(); }`
(`TableChart.tsx:124-126`). Because `DateWithFormatter` extends `Date`, this
coercion
rewrites the filter value to epoch milliseconds, so the receiving
chart/backend now sees
numeric epochs instead of the original temporal literal, changing filter
semantics and
potentially breaking engines that expect the literal format.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=1de5bfd01e784693836117ca0bd3133b&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=1de5bfd01e784693836117ca0bd3133b&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset-frontend/plugins/plugin-chart-table/src/TableChart.tsx
**Line:** 124:126
**Comment:**
*Incorrect Condition Logic: The new Date coercion converts every
`Date`/`DateWithFormatter` filter value to epoch milliseconds, not just
numeric-string epochs. Because all temporal cells are wrapped as
`DateWithFormatter`, non-epoch temporal values (for example ISO strings) now
get rewritten to numbers, which changes filter semantics and can break backends
that expect the original temporal literal. Restrict this conversion to true
epoch-like inputs (or use `DateWithFormatter.input` for non-numeric values)
instead of coercing all `Date` instances.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F40180&comment_hash=b3c9fd4ea28a60c7abbfe1191bc8c25797753b08a6305158e3315164abcfef0b&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F40180&comment_hash=b3c9fd4ea28a60c7abbfe1191bc8c25797753b08a6305158e3315164abcfef0b&reaction=dislike'>👎</a>
##########
superset/models/helpers.py:
##########
@@ -2637,21 +2637,50 @@ def filter_values_handler( # pylint:
disable=too-many-arguments # noqa: C901
if values is None:
return None
- def handle_single_value(value: Optional[FilterValue]) ->
Optional[FilterValue]:
- if operator == utils.FilterOperator.TEMPORAL_RANGE:
- return value
+ temporal_comparison_operators: set[utils.FilterOperator] = {
+ utils.FilterOperator.EQUALS,
+ utils.FilterOperator.NOT_EQUALS,
+ utils.FilterOperator.IN,
+ utils.FilterOperator.NOT_IN,
+ utils.FilterOperator.GREATER_THAN,
+ utils.FilterOperator.LESS_THAN,
+ utils.FilterOperator.GREATER_THAN_OR_EQUALS,
+ utils.FilterOperator.LESS_THAN_OR_EQUALS,
+ }
+
+ def handle_temporal_value(value: FilterValue) -> FilterValue |
ColumnElement:
if (
- isinstance(value, (float, int))
- and target_generic_type == utils.GenericDataType.TEMPORAL
- and target_native_type is not None
- and db_engine_spec is not None
+ operator not in temporal_comparison_operators
+ or target_generic_type != utils.GenericDataType.TEMPORAL
+ or target_native_type is None
+ or db_engine_spec is None
):
- value = db_engine_spec.convert_dttm(
- target_type=target_native_type,
- dttm=datetime.utcfromtimestamp(value / 1000),
- db_extra=db_extra,
+ return value
+
+ if isinstance(value, (float, int)) and not isinstance(value, bool):
+ epoch_ms: float = value
+ elif isinstance(value, str) and re.fullmatch(r"[+-]?\d+", value):
+ epoch_ms = int(value)
Review Comment:
**Suggestion:** The temporal coercion currently treats any all-digit string
(and any numeric value) as an epoch-millisecond timestamp, which will silently
mis-convert valid non-epoch temporal inputs like compact date strings
(`YYYYMMDD`) or epoch-second values into 1970-era datetimes. Add a stricter
epoch detection rule (for example, expected length/range and optional
seconds-vs-milliseconds handling) before converting, so only true
epoch-millisecond drill/cross-filter payloads are coerced. [logic error]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Explore SQLA queries mis-filter temporal columns for digit dates.
- ⚠️ Dashboard drill-to-detail may show incorrect temporal records.
- ⚠️ Cross-filter queries using numeric temporal payloads risk mis-coercion.
- ⚠️ Programmatic chart-data API clients can get silently wrong results.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. In Python code or a unit test, construct a temporal filter that targets a
real date
using a compact digit-only string, for example:
- File `superset/tests/unit_tests/models/helpers_test.py`
- Add a test similar to
`test_temporal_epoch_string_filter_is_coerced_for_bigquery`
(lines 16–34) but with `values="20260513"` and
`target_native_type="DATE"`.
2. Call `ExploreMixin.filter_values_handler` (defined in
`superset/models/helpers.py:2626-120`) directly:
- `values="20260513"`
- `operator=FilterOperator.EQUALS`
- `target_generic_type=GenericDataType.TEMPORAL`
- `target_native_type="DATE"`
- `db_engine_spec=BigQueryEngineSpec` (or another engine spec that
implements
`convert_dttm` for DATE).
3. Inside `filter_values_handler`, `handle_single_value` (lines 82–110 in
the same file
chunk) receives the string, strips whitespace, and because
`target_generic_type` is
TEMPORAL, it calls `handle_temporal_value(value)` (line 105). In
`handle_temporal_value`
(lines 52–80):
- The operator is in `temporal_comparison_operators` (lines 41–49).
- `target_generic_type` is TEMPORAL and `target_native_type` and
`db_engine_spec` are
non-null.
- The `elif isinstance(value, str) and re.fullmatch(r"[+-]?\d+", value)`
branch at
lines 63–64 matches `"20260513"` and sets `epoch_ms = int(value)`,
treating it as epoch
milliseconds.
4. Still inside `handle_temporal_value`, `datetime.fromtimestamp(epoch_ms /
1000,
tz=timezone.utc)` (lines 68–71) computes a timestamp only ~5.6 hours after
the Unix epoch
(because `20260513` is treated as milliseconds, not as a calendar date or
epoch seconds).
`db_engine_spec.convert_dttm(target_type="DATE", dttm=...)` (lines 75–79)
then produces a
DATE literal for this 1970 date, and `literal_column(temporal_sql)` is
returned. When
`get_sqla_query` later applies this value in its filter construction (lines
60–88 in the
3600–3719 chunk), the generated SQL filters on an incorrect 1970-01-01-ish
date instead of
the intended 2026-05-13, demonstrating the silent mis-conversion that the
suggestion
describes. This same misinterpretation occurs for epoch-second values (e.g.
`"1778630400"`) and any other non-epoch digit-only temporal strings because
there is no
length/range check around lines 61–65.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=03db1140f23e492194fd23216b0e8764&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=03db1140f23e492194fd23216b0e8764&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/models/helpers.py
**Line:** 2660:2663
**Comment:**
*Logic Error: The temporal coercion currently treats any all-digit
string (and any numeric value) as an epoch-millisecond timestamp, which will
silently mis-convert valid non-epoch temporal inputs like compact date strings
(`YYYYMMDD`) or epoch-second values into 1970-era datetimes. Add a stricter
epoch detection rule (for example, expected length/range and optional
seconds-vs-milliseconds handling) before converting, so only true
epoch-millisecond drill/cross-filter payloads are coerced.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F40180&comment_hash=00d297160c77db023deb51b7a36d82dff9d68a45d37c32afd1847c67bc915933&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F40180&comment_hash=00d297160c77db023deb51b7a36d82dff9d68a45d37c32afd1847c67bc915933&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
