QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-04-19 08:04:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Validate jinja rendered query (#22851)

Browse Source
This commit is contained in:
Geido
2023-02-21 11:01:12 +01:00
committed by GitHub
parent 5482f78a9c
commit c7823e32ff
2 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
tests/integration_tests/sqllab_tests.py
View File

@@ -736,6 +736,38 @@ class TestSqlLab(SupersetTestCase):
"undefined_parameters": ["stat"],
}
@pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
@mock.patch.dict(
"superset.extensions.feature_flag_manager._feature_flags",
{"ENABLE_TEMPLATE_PROCESSING": True},
clear=True,
)
def test_sql_json_parameter_authorized(self):
self.login("admin")
data = self.run_sql(
"SELECT name FROM {{ table }} LIMIT 10",
"3",
template_params=json.dumps({"table": "birth_names"}),
)
assert data["status"] == "success"
@pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
@mock.patch.dict(
"superset.extensions.feature_flag_manager._feature_flags",
{"ENABLE_TEMPLATE_PROCESSING": True},
clear=True,
)
def test_sql_json_parameter_forbidden(self):
self.login("gamma")
data = self.run_sql(
"SELECT name FROM {{ table }} LIMIT 10",
"4",
template_params=json.dumps({"table": "birth_names"}),
)
assert data["errors"][0]["error_type"] == "GENERIC_BACKEND_ERROR"
@mock.patch("superset.sql_lab.get_query")
@mock.patch("superset.sql_lab.execute_sql_statement")
def test_execute_sql_statements(self, mock_execute_sql_statement, mock_get_query):