Commit Graph

13 Commits

Author SHA1 Message Date
Evan Rusackas
464e40619f test: cover the unparseable-mutated-SQL validation fallback
The superset/sql/ tree is held to 100% unit-test coverage in CI; the
SupersetParseError branch of the joined-block emptiness validation was
the only uncovered path after the shared build_statement_blocks refactor.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-17 17:42:18 -07:00
Evan Rusackas
6ab9d7480b fix(sqllab): guard empty mutated single-block queries, share block prep across paths
The empty-statement guard added for split engines never covered the
run_multiple_statements_as_one branch: with MUTATE_AFTER_SPLIT=True the
per-statement mutator outputs were joined into a single block with no
check that any executable SQL remained, so an empty/comment-only mutator
result bypassed the clean INVALID_SQL_ERROR and reached execution as an
empty block. (An earlier review reply claimed this was fixed, but the
commit never landed.)

Per review feedback, the whole run_multiple_statements_as_one ×
MUTATE_AFTER_SPLIT matrix now lives in one shared helper,
build_statement_blocks() in superset/sql/execution/executor.py, used by
both the sync (sql_lab.py) and async (celery_task.py) paths, so the two
can't drift again. The new guard validates the joined block via SQLScript
and raises the same INVALID_SQL_ERROR as the split-engine branch; if the
mutator emits engine-specific SQL our parser can't handle, validation is
skipped and the database stays the authority on validity.

Regression tests cover the previously-unguarded matrix cell in both the
sync and async suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-17 17:42:18 -07:00
Evan
ed510633ce fix(sql-lab): address minor type-hint nits from codeant review
Add explicit type annotations for the `blocks` list in sql_lab.py and
the mock/cursor test variables, and replace an untyped lambda mutator
with a typed helper to keep MUTATE_AFTER_SPLIT type-hint coverage
consistent with the rest of the PR.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 17:42:18 -07:00
Evan
bf85efdbb7 fix(sqllab): mutate per-statement when engine runs statements as one block
MUTATE_AFTER_SPLIT=True never fired the mutator for engines with
run_multiple_statements_as_one=True (BigQuery, Datastore, Kusto), since
those engines always build a single joined block and the per-block
mutation call always passes is_split=False. Mutate each statement
before joining them into that block so the flag applies consistently.

Verified separately via a full `pre-commit run` (all hooks touching
these files passed: auto-walrus, mypy, ruff-format, ruff, pylint) run
outside the git hook, whose invocation via the system /usr/bin/python3
hits an unrelated pre-existing environment issue installing the zizmor
hook (requires Python >=3.10, system python3 here is older) rather
than anything in this change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 17:42:18 -07:00
Evan
408f5112e2 fix: cover MUTATE_AFTER_SPLIT branches, guard empty/mismatched mutated statements
Add missing coverage for the MUTATE_AFTER_SPLIT=True branch, add type
hints to satisfy dev-standard lint, and guard against a SQL_QUERY_MUTATOR
that strips all statements or changes statement count when mutating
before the split.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 17:42:17 -07:00
Evan
bf6d5b1faa fix(sqllab): mutate the whole query before splitting when MUTATE_AFTER_SPLIT=False
The prior fix derived is_split purely from run_multiple_statements_as_one, so
for the common case (engines that execute statements individually) with the
default MUTATE_AFTER_SPLIT=False, is_split was always True and the mutator
never fired at all -- a regression from the pre-fix behavior where it always
ran. Mutate the whole, un-split query once before splitting into per-statement
blocks when MUTATE_AFTER_SPLIT is False, in both the sync (sql_lab.py) and
async (celery_task.py) SQL Lab paths, and add regression tests covering both
flag values across both engine modes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 17:42:17 -07:00
Evan
353250027c fix(sqllab): apply SQL_QUERY_MUTATOR in SQL Lab when MUTATE_AFTER_SPLIT is set
SQL Lab passed the default is_split=False to mutate_sql_based_on_config for
every block, so SQL_QUERY_MUTATOR fired only when MUTATE_AFTER_SPLIT=False and
never when True. Pass is_split based on whether the engine runs statements as
one block, matching the canonical usage in db_engine_specs and the new
execution engine, and thread the same flag through execute_sql_with_cursor so
the async (Celery) path is consistent. Adds unit tests for both the guard
semantics and the executor contract, plus a config note.

Closes #30169
Supersedes #34111

Co-authored-by: Lucas Wolkersdorfer <lucas.wolkersdorfer@rise-world.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 17:42:17 -07:00
Shaitan
2da2db6c7c feat(sql): schema-qualified table denylist + information_schema/lo_* defaults (#41120)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 16:57:45 +01:00
Evan Rusackas
1632b235ae fix(sqllab): surface stacktrace in SQL Lab error responses (#28248) (#40585)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-02 10:41:39 -07:00
Amin Ghadersohi
68067d7f44 fix(mcp): handle OAuth-authenticated databases in execute_sql (#39166) 2026-04-09 15:47:00 -04:00
Michael S. Molina
357e35dc62 refactor(core): reorganize superset-core packages into feature-based structure (#38448) 2026-03-05 17:41:15 -03:00
Amin Ghadersohi
15b3c96f8e fix(security): Add table blocklist and fix MCP SQL validation bypass (#37411) 2026-02-09 14:12:06 +01:00
Michael S. Molina
28e3ba749e feat: SQL execution API for Superset (#36529)
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-12-16 14:39:29 -03:00