QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-08-05 21:42:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,528 Commits 554 Branches 562 Tags
63603ec3697d757160b6e869a1cdbc00ffa3d204
Commit Graph

35 Commits

Author SHA1 Message Date
Evan
63603ec369 fix(sqllab): keep RLS schema probe out of the session + always run the schema gate 
Addresses review feedback on the cost-estimate security-parity path:

- The transient Query built to resolve the per-query schema joined the
  session via the `database` backref's `cascade="all, delete-orphan"`.
  With no `client_id` (nullable=False) it autoflushed into an IntegrityError
  the moment `apply_rls` issued its own session query, 500-ing every
  RLS-enabled estimate that references a table. Mirror the probe pattern in
  `SupersetSecurityManager.raise_for_access`: set `client_id`/`user_id` and
  `db.session.expunge` the probe.
- `get_default_schema_for_query` was skipped whenever the caller pinned a
  schema, bypassing the engine's per-query gate (e.g. Postgres rejecting
  `SET search_path`) that the executor runs unconditionally. Always resolve
  through it; an explicit schema still wins as the RLS predicate target.

Unit tests patch the session (so they can't see the autoflush); add an
integration test exercising a real session + real `apply_rls` that would
have caught the regression, and flip the explicit-schema test to assert the
gate now runs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-10 14:59:51 -07:00
Beto Dealmeida
edf4d03218 chore: bump rison to 2.0.0 (#39529) 2026-04-24 15:52:42 -04:00
JUST.in DO IT
0b51e9cd5e fix(sqllab): format_sql to apply db dialect by database_id (#39393) 2026-04-16 08:27:51 -03:00
Shaitan
f49310b8ff fix(sql-lab): apply access check in SqlExecutionResultsCommand (#38952) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-09 16:47:15 -04:00
Luis Sánchez
e7c060466d fix(SqlLab): enhance SQL formatting with Jinja template support. (#36277) 2025-12-08 15:32:05 -08:00
Daniel Vaz Gaspar
348b19cb4c fix(sqllab): validate results backend writes and enhance 410 diagnostics (#36222) 2025-11-21 15:05:48 +00:00
Maxime Beauchemin
cb27d5fe8d chore: proper current_app.config proxy usage (#34345) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-07-31 19:27:42 -07:00
Maxime Beauchemin
3f8472ca7b chore: move some rules from ruff -> pylint (#34292) 2025-07-24 09:40:49 -07:00
Ahmed Habeeb
43775e9373 fix(sqllab_export): manually encode CSV output to support utf-8-sig (#34235) 2025-07-23 18:44:56 -07:00
Beto Dealmeida
8de58b9848 feat: use sqlglot to set limit (#33473) 2025-05-27 15:20:02 -04:00
Evan Rusackas
90651dfe3e fix(dev/ci): pre-commit fixes galore (#32352) 2025-02-24 11:26:45 -07:00
Levis Mbote
2c37ddb2f6 fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. (#32284) 2025-02-21 15:42:35 -07:00
JUST.in DO IT
2874096e27 refactor(sqllab): migrate share queries via kv by permalink (#29163) 2025-01-17 16:16:02 -08:00
Maxime Beauchemin
e51b95ffa8 chore: enforce more ruff rules (#31447) 
Co-authored-by: Elizabeth Thompson <eschutho@gmail.com>
 2024-12-18 17:41:34 -08:00
Beto Dealmeida
47c1e09c75 fix: sqlparse fallback for formatting queries (#30578) 2024-10-11 15:45:40 -04:00
Maxime Beauchemin
a849c29288 chore: enable lint PT009 'use regular assert over self.assert.*' (#30521) 2024-10-07 13:17:27 -07:00
Josh Soref
1818054166 chore(tests): Spelling (#25454) 
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: John Bodley <4567245+john-bodley@users.noreply.github.com>
 2024-08-20 14:47:29 -06:00
Eyal Ezer
07b2449bd7 refactor: Unify all json.(loads|dumps) usage to utils.json (#28702) 
Co-authored-by: Eyal Ezer <eyal.ezer@ge.com>
 2024-05-28 14:17:41 -07:00
Maxime Beauchemin
2d63722150 chore: set up ruff as a new linter/formatter (#28158) 2024-04-24 17:19:53 -07:00
John Bodley
481a63da55 chore(tests): Remove ineffectual login (#27149) 2024-04-09 09:52:02 -07:00
JUST.in DO IT
f4bdcb5743 perf(sqllab): reduce bootstrap data delay by queries (#27488) 2024-03-18 12:52:23 -07:00
Beto Dealmeida
26d8077e97 chore: improve SQL parsing (#26767) 2024-03-13 18:27:01 -04:00
JUST.in DO IT
5107cc0fd9 fix(sqllab): Close already removed tab (#27391) 2024-03-06 08:59:56 -08:00
John Bodley
7af82ae87d refactor: Ensure Celery leverages the Flask-SQLAlchemy session (#26186) 2024-01-17 17:06:22 +13:00
John Bodley
07bcfa9b5f chore(command): Organize Commands according to SIP-92 (#25850) 2023-11-22 16:55:54 -03:00
JUST.in DO IT
24a2213445 feat(sqllab): Format sql (#25344) 2023-11-03 09:38:11 -07:00
JUST.in DO IT
7aaae06c9d fix(sqllab): invalid persisted tab state (#25308) 2023-09-19 15:58:34 -07:00
Sebastian Liebscher
e585db85b6 chore: use contextlib.surpress instead of passing on error (#24896) 
Co-authored-by: John Bodley <4567245+john-bodley@users.noreply.github.com>
 2023-08-29 10:09:01 -06:00
JUST.in DO IT
10abb68288 feat(sqllab): Add /sqllab endpoint to the v1 api (#24983) 2023-08-16 16:09:10 -07:00
John Bodley
a4d5d7c6b9 chore(pre-commit): Add pyupgrade and pycln hooks (#24197) 2023-06-01 12:01:10 -07:00
Hugh A. Miles II
8fa77adf9a chore: Hugh/migrate estimate query cost to v1 (#23226) 
Co-authored-by: Diego Medina <diegomedina24@gmail.com>
 2023-03-17 18:02:25 -06:00
Daniel Vaz Gaspar
4b03d2553c fix: missing __init__ on module sqllab commands (#23107) 2023-02-17 11:08:14 +00:00
Diego Medina
e5a4c78dc7 chore: Migrate /superset/csv/<client_id> to API v1 (#22913) 2023-02-15 10:48:24 +00:00
Diego Medina
b94052e438 chore: migrate /sql_json and /results to apiv1 (#22809) 2023-01-30 11:02:34 -05:00
Jesse Yang
77db0651d8 feat(sql lab): display presto and trino tracking url (#20799) 2022-07-26 20:20:08 -07:00