codeant-ai-for-open-source[bot] commented on code in PR #43393:
URL: https://github.com/apache/superset/pull/43393#discussion_r3831865008
##########
superset/commands/importers/v1/utils.py:
##########
@@ -152,21 +196,47 @@ def load_configs(
try:
config = load_yaml(file_name, content)
+ # Stored secrets are only reusable when the incoming config
+ # still points at the same endpoint as the stored one; a UUID
+ # match alone must never rebind stored credentials to a new
+ # host (see database_connection_identity_unchanged).
+ db_secrets_reusable = (
+ prefix == "databases"
+ and database_connection_identity_unchanged(
+ db_sqlalchemy_uris.get(str(config.get("uuid"))),
+ config.get("sqlalchemy_uri"),
+ )
+ )
+ incoming_tunnel = config.get("ssh_tunnel") or {}
+ stored_tunnel_server = db_ssh_tunnel_servers.get(
+ str(config.get("uuid"))
+ )
Review Comment:
**Suggestion:** Invalid YAML whose top-level value is a scalar or list is
supposed to be reported through schema validation, but this added access
assumes `config` is a mapping before `schema.load(config)` runs. Such an input
raises `AttributeError` from `.get()` and bypasses the normal validation error
handling, causing the import to fail with an unexpected server-side error
instead of a structured invalid-config response. [type error]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Malformed import bundles produce unexpected server errors.
- ⚠️ Import dispatch loses structured schema validation responses.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/commands/importers/v1/utils.py
**Line:** 210:213
**Comment:**
*Type Error: Invalid YAML whose top-level value is a scalar or list is
supposed to be reported through schema validation, but this added access
assumes `config` is a mapping before `schema.load(config)` runs. Such an input
raises `AttributeError` from `.get()` and bypasses the normal validation error
handling, causing the import to fail with an unexpected server-side error
instead of a structured invalid-config response.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43393&comment_hash=03afcdda7dccd47323a9fc22b76bf7c5fc0aed7a78845b6d359d9b803cf8a17e&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43393&comment_hash=03afcdda7dccd47323a9fc22b76bf7c5fc0aed7a78845b6d359d9b803cf8a17e&reaction=dislike'>👎</a>
##########
superset/commands/dataset/importers/v1/utils.py:
##########
@@ -637,9 +661,12 @@ def load_data(data_uri: str, dataset: SqlaTable, database:
Database) -> None:
handlers.extend([_PeerValidatingHTTPHandler,
_PeerValidatingHTTPSHandler])
opener = request.build_opener(*handlers)
data = opener.open(data_uri) # pylint: disable=consider-using-with #
noqa: S310
+ # Cap the bytes materialized from the download, before and after gzip
+ # decompression (same per-file knob as ZIP bundle uploads).
+ max_bytes = app.config["ZIPPED_FILE_MAX_SIZE"]
if data_uri.endswith(".gz"):
data = gzip.open(data)
- df = pd.read_csv(data, encoding="utf-8")
+ df = pd.read_csv(_read_bounded(data, max_bytes), encoding="utf-8")
Review Comment:
**Suggestion:** The gzip branch applies `_read_bounded` only to decompressed
output, so the compressed HTTP response itself is not bounded. A gzip stream
can contain oversized headers, trailing data, or compressed members that cause
the importer to read and process more than `ZIPPED_FILE_MAX_SIZE` from the
remote URI even when the decompressed CSV remains within the limit. Bound the
response before decompression as well as the decompressed stream. [resource
leak]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Gzip dataset imports can exceed the configured raw payload cap.
- ⚠️ Repeated imports consume excessive network and decompression resources.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/commands/dataset/importers/v1/utils.py
**Line:** 667:669
**Comment:**
*Resource Leak: The gzip branch applies `_read_bounded` only to
decompressed output, so the compressed HTTP response itself is not bounded. A
gzip stream can contain oversized headers, trailing data, or compressed members
that cause the importer to read and process more than `ZIPPED_FILE_MAX_SIZE`
from the remote URI even when the decompressed CSV remains within the limit.
Bound the response before decompression as well as the decompressed stream.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43393&comment_hash=514caadcf7cbd0d4d6e6b9922264cd5a1347ab39c17cf61fd7261d2bb9c7f830&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43393&comment_hash=514caadcf7cbd0d4d6e6b9922264cd5a1347ab39c17cf61fd7261d2bb9c7f830&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
