rusackas commented on code in PR #42295:
URL: https://github.com/apache/superset/pull/42295#discussion_r3627306288
##########
tests/unit_tests/security/manager_test.py:
##########
@@ -669,6 +669,101 @@ def test_query_context_modified_tampered(
assert query_context_modified(query_context)
+def test_query_context_modified_singular_metric_param(
+ mocker: MockerFixture,
+) -> None:
+ """
+ A chart storing its metric under the singular ``metric`` params key (big
+ number, world map, ...) generates a payload with a plural ``metrics`` list;
+ replaying the chart's own metric is not tampering.
+ """
+ query_context = mocker.MagicMock()
+ query_context.slice_.id = 42
+ query_context.slice_.query_context = None
+ query_context.slice_.params_dict = {
+ "metric": "sum__SP_POP_TOTL",
+ "groupby": [],
+ }
+
+ query_context.form_data = {
+ "slice_id": 42,
+ "metric": "sum__SP_POP_TOTL",
+ }
Review Comment:
form_data using singular `metric` is deliberate, that's what a
big-number/world-map control actually sends. The plural `metrics` on
`query_context.queries` is the generated payload, not a restated form_data. No
mismatch here, leaving as-is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
