SEPURI-SAI-KRISHNA commented on code in PR #45433:
URL: https://github.com/apache/superset/pull/45433#discussion_r4371387738
##########
tests/unit_tests/utils/csv_tests.py:
##########
@@ -292,6 +292,254 @@ def test_df_to_escaped_csv_non_default_index():
assert rows[2] == ["girl Mary", "safe"]
+def test_df_to_escaped_csv_escapes_index_labels():
+ """
+ Formulas in row labels are escaped too, not just cells and headers.
+
+ Pivot post-processing promotes the row dimension's values into the index,
+ and both export paths write the index out once it is no longer a
+ RangeIndex, so a hostile warehouse string can reach the first column of
+ the file.
+ """
+ df = pd.DataFrame(
+ data={"SUM(num)": [10.0, 20.0]},
+ index=pd.Index(['=cmd|" /C calc"!A0', "safe"], name="dim"),
+ )
+
+ rows = df_to_escaped_csv(df, encoding="utf8",
index=True).strip().split("\n")
+
+ assert rows[1].startswith("\"'=cmd")
+ assert rows[2].startswith("safe,")
+ # The caller's frame is left alone.
+ assert df.index.tolist() == ['=cmd|" /C calc"!A0', "safe"]
Review Comment:
Confirmed, and it is the plural wrapper carrying it. With `escape_axis_level`
switched to `level.map(escape_value)` all 27 tests still passed, and
`pd.Index(["=cmd()", 9007199254740993, None])` then raises
`TypeError: 'int' object is not subscriptable` from
`_starts_like_spreadsheet_formula`, which reads `value[0]`.
Added as
`test_df_to_escaped_csv_escapes_a_flat_index_mixing_a_formula_and_non_strings`,
asserting `dim,v\n'=cmd(),1\n9007199254740993,2\n,3\n`. It is the only test
in
the file that fails under that mutation. The id past 2**53 survives because
the
formula string holds the re-inferred dtype at `object`.
It turned out to pin a second thing. A flat index may hold the same label
twice, so the two labels escaping to one that `levels` rejects are ordinary
here and this path needs no `factorize`. That asymmetry was undocumented and
unpinned; rebuilding the flat path the way the MultiIndex one is built now
fails this same test, because factorizing an object index of a string, a
large
integer and a null does not reconstruct it. Noted it in `escape_axis_level`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
