bito-code-review[bot] commented on code in PR #44351:
URL: https://github.com/apache/superset/pull/44351#discussion_r4051844116
##########
superset/mcp_service/chart/tool/get_chart_sql.py:
##########
@@ -509,6 +521,15 @@ async def _handle_chart_sql_request(
error_type="Unsupported",
)
+ # Eagerly refresh all attributes while the session is still active. The
+ # log_context commit above (DBEventLogger.log) expires this instance via
+ # SQLAlchemy's expire_on_commit, and the awaits below are real event-loop
+ # yield points after which the MCP per-call session can be torn down —
+ # a later lazy reload (e.g. chart.params in _resolve_effective_form_data,
+ # chart.query_context in _sql_from_saved_query_context) would then raise
+ # DetachedInstanceError. See get_chart_preview.py for the same pattern.
+ db.session.refresh(chart)
Review Comment:
<div>
<div id="suggestion">
<div id="issue"><b>Unguarded session refresh</b></div>
<div id="fix">
`db.session.refresh(chart)` is unguarded, but sibling tools guard this exact
call: `generate_chart.py` wraps `refresh` in `try/except SQLAlchemyError` and
continues, and `get_chart_preview.py` does the same. A transient metadata-DB
failure here now fails the whole request via the new `SQLAlchemyError` handler
for what is a defensive freshness reload. Guard it and continue with a warning,
matching the established pattern.
</div>
</div>
<small><i>Code Review Run #903f7c</i></small>
</div>
---
Should Bito avoid suggestions like this for future reviews? (<a
href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
- [ ] Yes, avoid them
##########
superset/mcp_service/chart/tool/get_chart_sql.py:
##########
@@ -454,6 +455,17 @@ async def get_chart_sql(
try:
return await _handle_chart_sql_request(request, ctx)
+ except SQLAlchemyError as e:
+ await ctx.error(
+ "Chart SQL retrieval failed due to database session error: "
+ "identifier=%s, error_type=%s, error=%s"
+ % (request.identifier, type(e).__name__, str(e))
+ )
+ logger.exception("SQLAlchemy error in get_chart_sql: %s", e)
Review Comment:
<div>
<div id="suggestion">
<div id="issue"><b>CWE-209: DB Error Detail Leakage</b></div>
<div id="fix">
The new handler returns raw SQLAlchemy exception text to the MCP client via
`ChartError.error`; driver messages can embed SQL fragments, constraint/table
names, or host details. The `ctx.error` log already captures full detail
server-side. Return a generic message (keep `type(e).__name__`) and reserve
`{e}` for logs. Note `error_type="DatabaseError"` is not used elsewhere in
`chart/tool/` (`DataError` is).
([CWE-209](https://cwe.mitre.org/data/definitions/209.html))
</div>
</div>
<small><i>Code Review Run #903f7c</i></small>
</div>
---
Should Bito avoid suggestions like this for future reviews? (<a
href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
- [ ] Yes, avoid them
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
