codeant-ai-for-open-source[bot] commented on code in PR #42598: URL: https://github.com/apache/superset/pull/42598#discussion_r3706188151
########## superset/extensions/metadb.py: ########## @@ -70,6 +73,25 @@ from superset import db, feature_flag_manager, security_manager from superset.sql.parse import Table +# Counts references to `superset://` virtual tables in the statement being +# executed against the engine. Those tables are always addressed as +# double-quoted `database[[.catalog].schema].table` identifiers (see the +# dialect docstring below), since the literal dot(s) would otherwise be +# parsed as a schema/catalog separator, so this also catches multi-table +# statements that don't use the `JOIN` keyword, e.g. an implicit comma join +# like `FROM "database1.table1", "database2.table2" WHERE ...`. Shillelagh +# calls `SupersetShillelaghAdapter.get_data` once per underlying table, +# independently of any other table referenced by the same statement, so it +# has no way on its own to tell whether it's being asked for a standalone +# table or for one side of a multi-table query. +# `SupersetAPSWDialect.do_execute*` populates `_executing_multi_table_query` +# for the duration of a statement so that `get_data` can tell the two cases +# apart (see `get_data` for why this matters). +_TABLE_REF_RE = re.compile(r'"[^"]*\.[^"]*"') Review Comment: **Suggestion:** The table-reference regex is not SQL-aware and also matches double-quoted text inside SQL comments or other non-table expressions. For example, a single-table query followed by a comment containing `"fake.table"` is classified as multi-table, causing `get_data` to skip `SUPERSET_META_DB_LIMIT` and fetch the entire remote table. Parse table references from the SQL structure or remove comments before counting references so the configured safety limit remains effective. [security] <details> <summary><b>Severity Level:</b> Major ⚠️</summary> ```mdx - ⚠️ Single-table meta-database queries can bypass row limiting. - ⚠️ Large remote reads can increase memory and query-resource usage. ``` </details> [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=2d712e8596fd44ae84638df1669c11da&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=2d712e8596fd44ae84638df1669c11da&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) *(Use Cmd/Ctrl + Click for best experience)* <details> <summary><b>Prompt for AI Agent 🤖 </b></summary> ```mdx This is a comment left during a code review. **Path:** superset/extensions/metadb.py **Line:** 90:90 **Comment:** *Security: The table-reference regex is not SQL-aware and also matches double-quoted text inside SQL comments or other non-table expressions. For example, a single-table query followed by a comment containing `"fake.table"` is classified as multi-table, causing `get_data` to skip `SUPERSET_META_DB_LIMIT` and fetch the entire remote table. Parse table references from the SQL structure or remove comments before counting references so the configured safety limit remains effective. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42598&comment_hash=a16d56d5c2fa052eef8cb2a32e92fa4fb53a40dc44c79d557e22e395ecc50279&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42598&comment_hash=a16d56d5c2fa052eef8cb2a32e92fa4fb53a40dc44c79d557e22e395ecc50279&reaction=dislike'>👎</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
