codeant-ai-for-open-source[bot] commented on code in PR #41492:
URL: https://github.com/apache/superset/pull/41492#discussion_r3664416353
##########
superset-frontend/src/SqlLab/components/EditorWrapper/useKeywords.ts:
##########
@@ -54,19 +55,28 @@ const getHelperText = (value: string) =>
};
// Names that aren't simple identifiers (spaces, punctuation, leading digits)
-// must be double-quoted to be valid SQL, with embedded quotes doubled.
+// must be quoted to be valid SQL. The quote characters are dialect-specific
+// (e.g. ANSI double quotes, MySQL/MariaDB backticks, SQL Server square
brackets)
+// and are provided by the backend's database engine spec via
`engine_information`
+// so the mapping isn't duplicated here. Embedded quote characters are escaped
by
+// doubling the closing character.
+type IdentifierQuote = { start: string; end: string };
+const ANSI_QUOTE: IdentifierQuote = { start: '"', end: '"' };
const SIMPLE_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const quoteIdentifier = (identifier: string) =>
+const quoteIdentifier = (
+ identifier: string,
+ { start, end }: IdentifierQuote = ANSI_QUOTE,
+) =>
SIMPLE_IDENTIFIER_RE.test(identifier)
? identifier
- : `"${identifier.replace(/"/g, '""')}"`;
+ : `${start}${identifier.split(end).join(`${end}${end}`)}${end}`;
Review Comment:
**Suggestion:** Reserved words such as `select`, `table`, or `from` match
`SIMPLE_IDENTIFIER_RE` and are therefore inserted without quoting. Selecting a
table whose name is a SQL keyword produces invalid SQL on engines that reserve
that word; include the dialect's reserved-word set in the quoting decision or
quote these identifiers as well. [logic error]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Reserved-word tables produce invalid SQL through autocomplete.
- ⚠️ Affects table insertion across supported SQL dialects.
- ⚠️ Users must manually quote affected table names.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Open SQL Lab with autocomplete enabled; `EditorWrapper` passes the active
query editor
context to `useKeywords()` at
`superset-frontend/src/SqlLab/components/EditorWrapper/index.tsx:285-294`.
2. Expand a schema containing a table whose actual name is a reserved word
such as
`select` or `from`; `useKeywords()` collects raw table values from fulfilled
table-list
queries at
`superset-frontend/src/SqlLab/components/EditorWrapper/useKeywords.ts:85-112`.
3. The table is exposed as an autocomplete entry by `tableKeywords` at
`superset-frontend/src/SqlLab/components/EditorWrapper/useKeywords.ts:175-188`,
which
calls `quoteIdentifier()` with that raw name.
4. At
`superset-frontend/src/SqlLab/components/EditorWrapper/useKeywords.ts:70-72`,
the
reserved word matches `SIMPLE_IDENTIFIER_RE`, so the autocomplete value and
`insertMatch()` caption remain unquoted; selecting the table inserts `select
` or `from `,
which the SQL parser interprets as syntax rather than a table identifier.
The existing SQL
keyword list confirms these words are treated as SQL keywords at
`superset-frontend/src/SqlLab/utils/sqlKeywords.ts:21-73`, while the current
tests only
cover `COVID Vaccines` and `simple_table` at
`superset-frontend/src/SqlLab/components/EditorWrapper/useKeywords.test.ts:156-212`.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=54071b34c0b3402798e84ab8f3fa870b&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=54071b34c0b3402798e84ab8f3fa870b&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:**
superset-frontend/src/SqlLab/components/EditorWrapper/useKeywords.ts
**Line:** 70:72
**Comment:**
*Logic Error: Reserved words such as `select`, `table`, or `from` match
`SIMPLE_IDENTIFIER_RE` and are therefore inserted without quoting. Selecting a
table whose name is a SQL keyword produces invalid SQL on engines that reserve
that word; include the dialect's reserved-word set in the quoting decision or
quote these identifiers as well.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41492&comment_hash=631bf1ff6ffe6c39e1f72304457e1949976800b7dc68db55221961cb3b137ed4&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41492&comment_hash=631bf1ff6ffe6c39e1f72304457e1949976800b7dc68db55221961cb3b137ed4&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
