EnxDev commented on code in PR #45342:
URL: https://github.com/apache/superset/pull/45342#discussion_r4292131251
##########
superset/commands/dataset/create.py:
##########
@@ -225,6 +225,7 @@ def validate(self) -> None: # noqa: C901
sql=sql,
catalog=catalog,
schema=schema,
+ allow_dataset_editorship=False,
Review Comment:
Confirmed and fixed in 78e7f8c801. Create now passes the dataset's parsed
`template_params` into `raise_for_access`, so `{{ t }}` gets checked against
what it renders to with the stored params. A template that fails to render
comes back as an invalid `sql` field instead of a 500.
Writing the test turned up a second gap on all three paths. Rendering reads
params through `json_to_dict`, which accepts a trailing comma. Update and
`/datasource/save/` parsed them with plain `json.loads`, so `{"t": "SELECT
secret FROM public.customer_pii",\n}` failed to parse in the check, the check
saw `{}`, and the SQL still rendered fine at query time. Create, update and
legacy save now share one helper built on `json_to_dict`, so the check and
rendering read the params the same way.
Tests: create with params, with a trailing comma, with no params, and the
render-error case (all fail without the change). Update got a trailing-comma
case, and the helper has its own table of inputs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
