bito-code-review[bot] commented on code in PR #44893:
URL: https://github.com/apache/superset/pull/44893#discussion_r4171521906
##########
superset/mcp_service/dashboard/schemas.py:
##########
@@ -2307,8 +2308,43 @@ def _validate_default_time_range(cls, v: str | None) ->
str | None:
return validate_time_range(v)
+class FilterRangeSpec(BaseNewFilterSpec):
+ """Spec for a new numerical range (filter_range) native filter."""
+
+ filter_type: Literal["filter_range"] = Field(
+ ..., description="Discriminator - must be 'filter_range'"
+ )
+ dataset_id: int = Field(..., description="ID of the dataset to filter on")
+ column: str = Field(
+ ...,
+ min_length=1,
+ description="Name of the numeric dataset column to filter on",
+ )
+ enable_empty_filter: bool = Field(
+ False, description="Require a value before the filter is applied"
+ )
+
+
+class FilterTimeGrainSpec(BaseNewFilterSpec):
+ """Spec for a new time grain (filter_timegrain) native filter."""
+
+ filter_type: Literal["filter_timegrain"] = Field(
+ ..., description="Discriminator - must be 'filter_timegrain'"
+ )
+ dataset_id: int = Field(
+ ...,
+ description=(
+ "ID of the dataset whose supported time grains this filter "
+ "offers and validates selections against"
+ ),
+ )
Review Comment:
<div>
<div id="suggestion">
<div id="issue"><b>CWE-20: Bool Coerced to Dataset ID</b></div>
<div id="fix">
Pydantic v2 lax mode coerces booleans for `dataset_id: int` (verified:
TypeAdapter(int).validate_python(True) -> 1 on installed pydantic 2.11.5), so
an MCP caller sending "dataset_id": true silently targets dataset 1 via
`_find_dataset_or_raise` in `_build_new_filter_config`. This file already
guards the identical bug for dashboard `identifier` (`reject_bool_identifier`,
line 2204); mirror that validator here.
([CWE-20](https://cwe.mitre.org/data/definitions/20.html))
</div>
</div>
<small><i>Code Review Run #eece08</i></small>
</div>
---
Should Bito avoid suggestions like this for future reviews? (<a
href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
- [ ] Yes, avoid them
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
