SEPURI-SAI-KRISHNA commented on code in PR #45433:
URL: https://github.com/apache/superset/pull/45433#discussion_r4356652509
##########
tests/unit_tests/utils/csv_tests.py:
##########
@@ -278,6 +279,203 @@ def test_df_to_escaped_csv_non_default_index():
assert rows[2] == ["girl Mary", "safe"]
+def test_df_to_escaped_csv_escapes_index_labels():
+ """
+ Formulas in row labels are escaped too, not just cells and headers.
+
+ Pivot post-processing promotes the row dimension's values into the index,
+ and both export paths write the index out once it is no longer a
+ RangeIndex, so a hostile warehouse string can reach the first column of
+ the file.
+ """
+ df = pd.DataFrame(
+ data={"SUM(num)": [10.0, 20.0]},
+ index=pd.Index(['=cmd|" /C calc"!A0', "safe"], name="dim"),
+ )
+
+ rows = df_to_escaped_csv(df, encoding="utf8",
index=True).strip().split("\n")
+
+ assert rows[1].startswith("\"'=cmd")
+ assert rows[2].startswith("safe,")
+ # The caller's frame is left alone.
+ assert df.index.tolist() == ['=cmd|" /C calc"!A0', "safe"]
+
+
+def test_df_to_escaped_csv_escapes_multiindex_labels_and_axis_names():
+ """
+ Every level of a MultiIndex is escaped, and so are the axis *names*.
+
+ Axis names are a separate attribute from the labels, so ``rename`` alone
+ leaves them untouched while pandas still writes them out as header cells.
+ A pivoted group-by puts a warehouse-controlled column name there.
+
+ Both levels carry a hostile label, since a pivot on two dimensions can put
+ one in either. Escaping only the innermost would leave the outer one in the
+ first column of the file.
+ """
+ df = pd.DataFrame(
+ data={"v": [1, 2]},
+ index=pd.MultiIndex.from_tuples(
Review Comment:
Confirmed, and the mutant is invisible to the whole suite. Factorizing
`level.map(escape_values)` with the original codes against each fixture:
```
hostile first in row order identical output
colliding labels identical output
big int sibling identical output
hostile second in row order shipped: safe,x,1 / '=cmd(),y,2
mutant: '=cmd(),x,1 / safe,y,2
```
So the rows swap and each label lands on the wrong one, which is worse than
the dtype bug since it misattributes data rather than reformatting it. `levels`
is sorted and `=` is 0x3D, so a label starting with it sorts after most text,
and every fixture I had happened to put the hostile label first.
Added
`test_df_to_escaped_csv_escapes_a_label_that_is_not_first_in_row_order` with
your assertion, using the file's existing level names:
```python
index=pd.MultiIndex.from_tuples([("safe", "x"), ("=cmd()", "y")],
names=["dim", "other"])
# "dim,other,v\nsafe,x,1\n'=cmd(),y,2\n"
```
Switching the rebuild to the level values fails it and nothing else.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
