SEPURI-SAI-KRISHNA opened a new pull request, #45433: URL: https://github.com/apache/superset/pull/45433
### SUMMARY Fixes #45432. `df_to_escaped_csv` escaped the column labels and the string cells but not the row labels or the axis names, and both export call sites write the index out once post-processing has replaced the range index (`include_index = not isinstance(df.index, pd.RangeIndex)` in `QueryContextProcessor`, `show_default_index` in `apply_client_processing`). A pivot export is that case: `pivot_table_v2` promotes the row dimension's warehouse values into the index and the dimension name into `index.name`, so a value starting with one of `PROBLEMATIC_CSV_PREFIXES` reached the first column of the file unescaped. CSV quoting does not neutralize it, the spreadsheet strips the quotes and evaluates the cell. The xlsx writer for the same frame already covered all four places: `superset.utils.excel.quote_formulas` quotes cells, column labels, index labels and axis names (#43396). This applies the same coverage to the CSV writer, so one chart's two exports agree. The escaping runs after the cell loop, so the labels the `.at` assignments address stay the ones the frame was handed over with. `rename` covers every level of a MultiIndex; the axis names are a separate attribute, hence the `rename_axis`. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF The real `apply_client_processing` CSV export of a pivot whose row dimension value is `=cmd|" /C calc"!A0`: Before: ``` ,SUM(num) "=cmd|"" /C calc""!A0",10.0 safe,20.0 ``` After: ``` ,SUM(num) "'=cmd\\|"" /C calc""!A0",10.0 safe,20.0 ``` which is what `df_to_excel` already produced for the same frame. ### TESTING INSTRUCTIONS ``` pytest tests/unit_tests/utils/csv_tests.py ``` Three new cases: a hostile row label on a single index (also asserting the caller's frame is left alone), a hostile label on the inner level of a MultiIndex together with a formula-triggering axis name, and a numeric index with negative labels to show ordinary exports are unchanged. ### ADDITIONAL INFORMATION - [x] Has associated issue: #45432 - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
