sha174n opened a new pull request, #42087:
URL: https://github.com/apache/superset/pull/42087
### SUMMARY
Stored calculated-column and metric expressions are validated at save time
(`validate_stored_expression`) and in the expression-validator helper, but not
at the point where they are rendered into the query. The save-time check can be
deferred past — Jinja templating (a `{{ ... }}` block is blanked before the
save-time parse), the create path (which has no expression validation), or
pre-existing data — after which the expression reaches `literal_column(...)`
unvalidated.
This routes stored expressions through the same `validate_adhoc_subquery`
gate that adhoc expressions already use, applied at each query sink:
`TableColumn.get_sqla_col` and `SqlMetric.get_sqla_col`,
`convert_tbl_column_to_sqla_col`, and the timestamp-expression path. That makes
the sub-query policy and RLS injection apply where the SQL is actually built,
consistent with the adhoc path. Save-time validation stays as defense in depth.
Completes the hardening started in #40392.
### TESTING INSTRUCTIONS
`pytest tests/unit_tests/connectors/sqla/models_test.py`
Adds `test_get_sqla_col_validates_stored_expression_at_query_time`:
`get_sqla_col` enforces the sub-query gate at query time even when the
save-time check is bypassed.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
