QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-13 02:05:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,821 Commits 532 Branches 555 Tags
0228ff4f33dc781da1dcb84b28858cc538fe33bf
Commit Graph

72 Commits

Author SHA1 Message Date
Evan
0228ff4f33 fix(sql): normalize comment clauses with base dialect to keep #36113 fix 
The comment-handling branch of sanitize_clause re-rendered through the
engine dialect, which re-applied the Postgres ROUND/CAST rewrite for any
clause containing a comment, reintroducing #36113. Re-render with the
base dialect instead so comments are normalized without engine-specific
semantic rewrites, and add a parametrized regression test for the
comment path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-23 19:40:08 -07:00
Evan
401d218992 fix(sql): strip trailing statement terminator in sanitize_clause 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-23 19:40:08 -07:00
Claude Code
f5a841b320 fix(sql): stop sanitize_clause from rewriting user SQL semantics (#36113) 
`sanitize_clause` round-tripped the user's clause through SQLGlot's dialect
generator and returned the re-rendered SQL. SQLGlot's Postgres dialect (borrowed
by engines such as Redshift, CockroachDB, Netezza and SAP HANA) rewrites
`ROUND(AVG(x), n)` into `ROUND(CAST(AVG(x) AS DECIMAL), n)`. On engines whose
unqualified DECIMAL defaults to scale 0, that injected cast rounds the aggregate
to an integer before the explicit ROUND, so `ROUND(AVG(0.949583), 4)` returns
`1` instead of `0.9496`.

This regressed when validation moved from sqlparse to SQLGlot; the legacy
implementation only validated the clause and returned it unchanged.

Validate by parsing as before, but return the original clause verbatim. Clauses
that contain comments are still re-rendered, since a trailing line comment can
comment out surrounding SQL once the clause is embedded into a larger query.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-23 19:40:08 -07:00
Claude Code
ee0a93771f test(sql): reproduce sanitize_clause mutating user aggregation SQL (#36113) 
Add a failing regression test for #36113. `sanitize_clause` round-trips a
user-authored clause through SQLGlot's dialect generator and returns the
re-rendered SQL. The Postgres dialect (borrowed by several engines) rewrites
`ROUND(AVG(x), n)` to `ROUND(CAST(AVG(x) AS DECIMAL), n)` at generation time;
on engines whose unqualified DECIMAL defaults to scale 0 the injected cast
rounds the aggregate before the explicit ROUND, producing wrong values.

The test asserts the clause is returned unchanged and currently fails for
postgresql/cockroachdb/netezza/hana.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-23 19:40:08 -07:00
Shaitan
215b207ae4 fix(sql): detect set operations and nested selects in subquery check (#38452) 
Co-authored-by: sha174n <pedro.sousa@preset.io>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-22 20:27:32 -07:00
Jean Dupuis
b2e5f80db2 fix(sql): preserve multi-arg DISTINCT in sanitize_clause and format (#39340) 2026-06-19 13:02:50 -07:00
Shaitan
6a1091d576 fix(sql): broaden mutating-statement detection in SQL Lab parser (#40421) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: sha174n <pedro.sousa@preset.io>
 2026-06-16 15:07:34 -07:00
Evan Rusackas
b85a2cdab1 fix: ODPS (MaxCompute) data source table preview failed (#38174) 
Co-authored-by: zhutong6688 <zhutong66@163.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
 2026-06-05 17:57:44 -07:00
Shaitan
56fd991efd fix(dataset): unify validation for stored and adhoc SQL expressions (#40392) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:55:50 +01:00
Shaitan
f7f50a7977 fix(sqllab): quote CTAS target identifiers and validate tmp_table_name format (#40245) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:25 +01:00
Shaitan
6eaee211aa fix(sqllab): require dataset match for raw query access (#40409) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-02 21:50:27 +01:00
Evan Rusackas
b97d3ef520 fix(api,sql): use json_response in Api.query and log dialect fallback (#40644) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:48:46 -07:00
Evan Rusackas
1632b235ae fix(sqllab): surface stacktrace in SQL Lab error responses (#28248) (#40585) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 10:41:39 -07:00
Evan Rusackas
c39a47cbac test(sql-parser): pin WITH+UNION as non-mutating across dialects (#25659) (#40138) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-20 10:08:21 -07:00
Alexandru Soare
b98bd2a07a fix(mcp): Block destructive DDL (DROP, TRUNCATE, ALTER) in execute_sql (#39621) 2026-05-20 14:29:15 +03:00
Evan Rusackas
b5ad4a7a07 test(sql-parser): pin TimescaleDB hyperfunctions parse on postgresql (#32028) (#40142) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-19 19:53:33 -07:00
Evan Rusackas
9bfa0642a1 test(sql-parser): pin quoted identifiers with spaces are not subqueries (#32541, #32684) (#40143) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-18 14:21:59 -07:00
Igor Khrol
3363b48180 fix(spark): register Spark SQLAlchemy dialect so spark:// URIs resolve to SparkEngineSpec (#38299) 
Co-authored-by: Joe Li <joe@preset.io>
 2026-05-12 12:33:17 -04:00
Beto Dealmeida
4311a15eb2 feat(sqlglot): Vertica dialect (#39969) 2026-05-08 14:34:34 -03:00
Vitor Avila
ad5e3170dd fix: OpenSearch dialect identifier delimiters (#39953) 2026-05-07 16:19:27 -03:00
Alexandru Soare
adfbbf1433 fix(sql): quote identifiers in transpile_to_dialect to fix case-sensitive column filters (#39521) 2026-05-06 10:53:09 +03:00
Vitor Avila
5af17c7976 fix(OpenSearch): OpenSearch dialect for sqlglot (#39538) 2026-04-22 12:17:15 -03:00
Luiz Otavio
0b419a07f5 fix: add comments to SQL clause validation (#39167) 2026-04-16 09:19:39 -03:00
Amin Ghadersohi
68067d7f44 fix(mcp): handle OAuth-authenticated databases in execute_sql (#39166) 2026-04-09 15:47:00 -04:00
Alexandru Soare
6465450b64 fix(firebolt): Firebolt SQL entered with EXCLUDE is rewritten to EXCEPT (#38742) 2026-03-19 10:21:50 -07:00
Beto Dealmeida
a854fa60a2 feat: apply RLS conservatively (#38683) 2026-03-17 10:20:09 -04:00
Michael S. Molina
357e35dc62 refactor(core): reorganize superset-core packages into feature-based structure (#38448) 2026-03-05 17:41:15 -03:00
Michael S. Molina
c41942a38a chore(deps): Upgrade sqlglot from 27.15.2 to 28.10.0 (#37841) 2026-02-10 13:13:11 -03:00
Amin Ghadersohi
15b3c96f8e fix(security): Add table blocklist and fix MCP SQL validation bypass (#37411) 2026-02-09 14:12:06 +01:00
Evan Rusackas
87bbd54d0a feat(examples): Transpile virtual dataset SQL on import (#37311) 
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Beto Dealmeida <roberto@dealmeida.net>
Co-authored-by: bito-code-review[bot] <188872107+bito-code-review[bot]@users.noreply.github.com>
 2026-01-22 09:50:05 -08:00
ankitajhanwar2001
d8f7ae83ee fix(sqlglot): use Athena dialect for awsathena parsing (#36747) 2026-01-12 10:06:46 -08:00
Michael S. Molina
28e3ba749e feat: SQL execution API for Superset (#36529) 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-12-16 14:39:29 -03:00
Evan Rusackas
c7a4d4f2cc fix(sql): handle backtick-quoted identifiers with base dialect (#36545) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-12-15 13:00:13 -08:00
Beto Dealmeida
e4cb84bc02 feat: DB2 dialect for sqlglot (#36365) 2025-12-02 12:19:52 -05:00
amaannawab923
186693b840 feat(ag-grid): add SQLGlot-based SQL escaping for where and having filter clauses (#36136) 2025-11-25 09:35:40 +02:00
Beto Dealmeida
f3e620cd0f fix: RLS in virtual datasets (#36061) 2025-11-14 14:21:09 -05:00
Vitor Avila
6701d0ae0c fix: Use singlestoredb dialect for sqlglot (#36096) 2025-11-13 16:10:55 -03:00
Beto Dealmeida
62dc5c0306 fix(cache): ensure SQL is sanitized before cache key generation (#35419) 2025-10-02 13:25:54 -04:00
Beto Dealmeida
3202ff4b3f fix(pinot): more functions (#35451) 2025-10-02 13:01:47 -04:00
Beto Dealmeida
30021f8ede fix(pinot): SUBSTR function (#35427) 2025-10-02 10:29:18 -04:00
Beto Dealmeida
f3349388d0 fix(pinot): DATE_SUB function (#35426) 2025-10-02 10:12:19 -04:00
Beto Dealmeida
5428376662 fix(pinot): DATE_ADD function (#35424) 2025-10-02 09:56:20 -04:00
Beto Dealmeida
aa97d2fe03 fix(pinot): dialect date truncation (#35420) 
Co-authored-by: bito-code-review[bot] <188872107+bito-code-review[bot]@users.noreply.github.com>
 2025-10-01 13:16:46 -04:00
Beto Dealmeida
bf88d9bb1c fix(pinot): restrict types in dialect (#35337) 2025-09-30 16:34:53 -04:00
Beto Dealmeida
4e093a8e2a feat: sqlglot dialect for Pinot (#35333) 2025-09-29 21:56:35 -04:00
Beto Dealmeida
5ec8f9d886 chore: bump sqlglot to 27.15.2 (#35176) 2025-09-22 12:40:16 -04:00
Evan Rusackas
7fb7ac8bef fix(sql): Add Impala dialect support to sqlglot parser (#34662) 
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Joe Li <joe@preset.io>
 2025-09-04 11:07:09 -07:00
Michael S. Molina
e1234b2264 fix: User-provided Jinja template parameters causing SQL parsing errors (#34802) 2025-08-22 14:39:14 -03:00
Beto Dealmeida
6fc734da51 fix: prevent anonymous code in Postgres (#34412) 2025-07-31 08:33:34 -04:00
Beto Dealmeida
122bb68e5a fix: subquery alias in RLS (#34374) 2025-07-28 22:58:15 -04:00