aminghadersohi commented on code in PR #43870:
URL: https://github.com/apache/superset/pull/43870#discussion_r4237969030
##########
superset/db_engine_specs/postgres.py:
##########
@@ -178,6 +178,15 @@ class PostgresBaseEngineSpec(BaseEngineSpec):
engine = ""
engine_name = "PostgreSQL"
+ # The engine's default text comparison is binary, so a mirrored
+ # ``partition_col = T(v)`` agrees with the ``col = v`` it stands in for.
+ binary_string_comparison = True
+
+ # PostgreSQL's date/time input reads the unseparated forms as well as the
+ # ISO ones -- ``'20260115'::date`` is 2026-01-15 -- so a ``YYYYMMDD``
+ # bucketing key mirrors here. Redshift inherits the same input parsing.
+ temporal_literal_formats = ("%Y%m%d", "%Y%m%d%H%M%S")
Review Comment:
`SnowflakeEngineSpec` (and Vertica, HANA, Netezza, Hologres) inherits this.
Snowflake's AUTO date input does not accept `YYYYMMDD` and converts all-digit
strings as epoch seconds, so the mirror `part_date = '20260115'` misreads.
Declare it on `PostgresEngineSpec`/`RedshiftEngineSpec` instead.
##########
superset/config.py:
##########
@@ -2553,6 +2585,24 @@ def engine_context_manager( # pylint:
disable=unused-argument
"getMacro",
"getSetting",
},
+ # Oracle functions that run a query handed to them as text. Same blind spot
+ # as PostgreSQL's XML and full-text families above: the statement they
+ # execute is a string, so the expression has no FROM clause and no
+ # sub-query of its own for a table-reference gate to see, and the rows come
+ # back without the dataset grants or row-level security the caller is
+ # subject to.
+ #
+ # Named bare rather than package-qualified: `DBMS_XMLGEN.GETXML(...)`
+ # parses as an anonymous function called `GETXML`, so the package prefix
+ # never reaches the matcher. `getclobval` and `extract` are deliberately
+ # absent -- they read an XMLType the caller already has rather than
+ # building one from a query.
+ "oracle": {
+ "getxml",
+ "getxmltype",
+ "newcontext",
+ "newcontextfromhierarchy",
Review Comment:
`DBURITYPE('/HR/EMPLOYEES/ROW[ID=1]/SALARY').getclob() || :value` clears
every transform gate (bare, no sub-query, not mutating, not denied) and reads a
table by path string: the same blind spot as `GETXML`, and PUBLIC by default.
```suggestion
"newcontextfromhierarchy",
# Reads a table by path string, e.g. DBURITYPE('/SCHEMA/TABLE/ROW').
"dburitype",
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
