fix(sqllab): correct post_results event logger action name; validate rows > 0

The POST /results/ handler was logging its event as `.get_results` instead
of `.post_results`, making the two endpoints indistinguishable in audit logs.

The `rows` field in SqlLabResultsSchema now rejects values < 1. Negative
values produce surprising slice semantics (`data[:-1]`) and zero is silently
ignored, so only positive integers are meaningful.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Evan
2026-06-01 18:18:39 -07:00
parent eec8dbce47
commit b34bed64d5
2 changed files with 3 additions and 2 deletions

View File

@@ -506,7 +506,7 @@ class SqlLabRestApi(BaseSupersetApi):
@statsd_metrics
@requires_json
@event_logger.log_this_with_context(
action=lambda self, *args, **kwargs: f"{self.__class__.__name__}.get_results",
action=lambda self, *args, **kwargs: f"{self.__class__.__name__}.post_results",
log_to_statsd=False,
)
def post_results(self) -> FlaskResponse:

View File

@@ -14,7 +14,7 @@
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
from marshmallow import fields, Schema
from marshmallow import fields, Schema, validate
from superset.databases.schemas import ImportV1DatabaseSchema
@@ -35,6 +35,7 @@ class SqlLabResultsSchema(Schema):
rows = fields.Integer(
required=False,
allow_none=True,
validate=validate.Range(min=1),
metadata={"description": "The maximum number of rows to return"},
)