sha174n opened a new pull request, #45633: URL: https://github.com/apache/superset/pull/45633
### SUMMARY A dataset metric's `d3format` was accepted as any string within the length limit. This adds server-side validation so the API only accepts a valid d3-format specifier or one of the named number formats the frontend recognises, rejecting anything else. A single predicate (`is_valid_d3_format` in `superset/utils/number_format.py`) backs the dataset PUT metric schema, the v1 import metric schema, and the MCP dataset-metric schemas. The named-format allowlist is kept in one constant, sourced from the frontend formatter registry (`setupFormatters.ts`, `NumberFormats.ts`, `D3_FORMAT_OPTIONS`). No model change or migration. ### TESTING INSTRUCTIONS Added unit tests for the validator and the dataset metric schemas (valid specifiers, named formats, invalid strings, over-length, and the offending-metric index), plus a dataset API test that an invalid format is rejected and nothing is stored. Existing `number_format` tests continue to pass. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime consequences of this change 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
