QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-09 00:05:36 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,474 Commits 525 Branches 554 Tags
ca2cb0f289a7ec224fa5c70e4afa44f1715f749f
Commit Graph

47 Commits

Author SHA1 Message Date
Evan
ca2cb0f289 fix(sql): strip trailing statement terminator in sanitize_clause 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-16 20:45:31 -07:00
Claude Code
b03b723928 fix(sql): stop sanitize_clause from rewriting user SQL semantics (#36113) 
`sanitize_clause` round-tripped the user's clause through SQLGlot's dialect
generator and returned the re-rendered SQL. SQLGlot's Postgres dialect (borrowed
by engines such as Redshift, CockroachDB, Netezza and SAP HANA) rewrites
`ROUND(AVG(x), n)` into `ROUND(CAST(AVG(x) AS DECIMAL), n)`. On engines whose
unqualified DECIMAL defaults to scale 0, that injected cast rounds the aggregate
to an integer before the explicit ROUND, so `ROUND(AVG(0.949583), 4)` returns
`1` instead of `0.9496`.

This regressed when validation moved from sqlparse to SQLGlot; the legacy
implementation only validated the clause and returned it unchanged.

Validate by parsing as before, but return the original clause verbatim. Clauses
that contain comments are still re-rendered, since a trailing line comment can
comment out surrounding SQL once the clause is embedded into a larger query.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-16 11:37:49 -07:00
Claude Code
390488c75f test(sql): reproduce sanitize_clause mutating user aggregation SQL (#36113) 
Add a failing regression test for #36113. `sanitize_clause` round-trips a
user-authored clause through SQLGlot's dialect generator and returns the
re-rendered SQL. The Postgres dialect (borrowed by several engines) rewrites
`ROUND(AVG(x), n)` to `ROUND(CAST(AVG(x) AS DECIMAL), n)` at generation time;
on engines whose unqualified DECIMAL defaults to scale 0 the injected cast
rounds the aggregate before the explicit ROUND, producing wrong values.

The test asserts the clause is returned unchanged and currently fails for
postgresql/cockroachdb/netezza/hana.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-16 11:35:05 -07:00
Evan Rusackas
b85a2cdab1 fix: ODPS (MaxCompute) data source table preview failed (#38174) 
Co-authored-by: zhutong6688 <zhutong66@163.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
 2026-06-05 17:57:44 -07:00
Shaitan
56fd991efd fix(dataset): unify validation for stored and adhoc SQL expressions (#40392) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:55:50 +01:00
Shaitan
f7f50a7977 fix(sqllab): quote CTAS target identifiers and validate tmp_table_name format (#40245) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:25 +01:00
Shaitan
6eaee211aa fix(sqllab): require dataset match for raw query access (#40409) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-02 21:50:27 +01:00
Evan Rusackas
b97d3ef520 fix(api,sql): use json_response in Api.query and log dialect fallback (#40644) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:48:46 -07:00
Evan Rusackas
c39a47cbac test(sql-parser): pin WITH+UNION as non-mutating across dialects (#25659) (#40138) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-20 10:08:21 -07:00
Alexandru Soare
b98bd2a07a fix(mcp): Block destructive DDL (DROP, TRUNCATE, ALTER) in execute_sql (#39621) 2026-05-20 14:29:15 +03:00
Evan Rusackas
b5ad4a7a07 test(sql-parser): pin TimescaleDB hyperfunctions parse on postgresql (#32028) (#40142) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-19 19:53:33 -07:00
Evan Rusackas
9bfa0642a1 test(sql-parser): pin quoted identifiers with spaces are not subqueries (#32541, #32684) (#40143) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-18 14:21:59 -07:00
Luiz Otavio
0b419a07f5 fix: add comments to SQL clause validation (#39167) 2026-04-16 09:19:39 -03:00
Beto Dealmeida
a854fa60a2 feat: apply RLS conservatively (#38683) 2026-03-17 10:20:09 -04:00
Michael S. Molina
c41942a38a chore(deps): Upgrade sqlglot from 27.15.2 to 28.10.0 (#37841) 2026-02-10 13:13:11 -03:00
Amin Ghadersohi
15b3c96f8e fix(security): Add table blocklist and fix MCP SQL validation bypass (#37411) 2026-02-09 14:12:06 +01:00
ankitajhanwar2001
d8f7ae83ee fix(sqlglot): use Athena dialect for awsathena parsing (#36747) 2026-01-12 10:06:46 -08:00
Evan Rusackas
c7a4d4f2cc fix(sql): handle backtick-quoted identifiers with base dialect (#36545) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-12-15 13:00:13 -08:00
Beto Dealmeida
f3e620cd0f fix: RLS in virtual datasets (#36061) 2025-11-14 14:21:09 -05:00
Vitor Avila
6701d0ae0c fix: Use singlestoredb dialect for sqlglot (#36096) 2025-11-13 16:10:55 -03:00
Beto Dealmeida
62dc5c0306 fix(cache): ensure SQL is sanitized before cache key generation (#35419) 2025-10-02 13:25:54 -04:00
Beto Dealmeida
5ec8f9d886 chore: bump sqlglot to 27.15.2 (#35176) 2025-09-22 12:40:16 -04:00
Michael S. Molina
e1234b2264 fix: User-provided Jinja template parameters causing SQL parsing errors (#34802) 2025-08-22 14:39:14 -03:00
Beto Dealmeida
6fc734da51 fix: prevent anonymous code in Postgres (#34412) 2025-07-31 08:33:34 -04:00
Beto Dealmeida
122bb68e5a fix: subquery alias in RLS (#34374) 2025-07-28 22:58:15 -04:00
Đỗ Trọng Hải
1a54b761c1 feat(db): remove Rockset DB support (#33929) 2025-06-27 23:12:54 +07:00
Beto Dealmeida
404f7c1043 feat: initial Dremio sqlglot dialect (#33847) 2025-06-20 12:05:45 -07:00
Beto Dealmeida
edc60914f6 chore: 100% test coverage for SQL parsing (#33568) 2025-06-04 22:18:09 -04:00
Beto Dealmeida
a26e1d822a chore: remove sqlparse (#33564) 2025-06-04 19:31:41 -04:00
Beto Dealmeida
ea5a609d0b feat: implement CVAS/CTAS in sqlglot (#33525) 2025-05-28 09:45:59 -04:00
Beto Dealmeida
0abe6eed89 feat: implement RLS in sqlglot (#33524) 2025-05-28 09:10:45 -04:00
Beto Dealmeida
e205846845 feat: implement CTEs logic in sqlglot (#33518) 2025-05-28 08:38:00 -04:00
Beto Dealmeida
0fa3feb088 chore: remove parse_sql (#33474) 2025-05-27 18:03:55 -04:00
Beto Dealmeida
1393f7d3d2 chore: sql/parse cleanup (#33515) 2025-05-27 16:42:04 -04:00
Beto Dealmeida
8de58b9848 feat: use sqlglot to set limit (#33473) 2025-05-27 15:20:02 -04:00
Beto Dealmeida
adeed60fe0 feat: implement limit extraction in sqlglot (#33456) 2025-05-22 20:09:36 -04:00
Beto Dealmeida
22fe985cfc fix(firebolt): allow backslach escape for single quotes (#32350) 2025-02-24 11:12:34 -05:00
Beto Dealmeida
4ca5846c7f feat: old Firebolt dialect (#31849) 2025-01-15 09:02:37 -05:00
Beto Dealmeida
c2d7cf388d feat: Firebolt sqlglot dialect (#31825) 2025-01-14 09:36:25 -05:00
Beto Dealmeida
e4b3ecd372 feat: push predicates into virtual datasets (#31486) 2025-01-08 22:11:28 -05:00
Maxime Beauchemin
e51b95ffa8 chore: enforce more ruff rules (#31447) 
Co-authored-by: Elizabeth Thompson <eschutho@gmail.com>
 2024-12-18 17:41:34 -08:00
Beto Dealmeida
09802acf0d refactor: remove more sqlparse (#31032) 2024-11-26 17:01:07 -05:00
Beto Dealmeida
fa7b66424c chore: add unit tests for is_mutating() (#31021) 2024-11-21 11:08:53 -05:00
Beto Dealmeida
47c1e09c75 fix: sqlparse fallback for formatting queries (#30578) 2024-10-11 15:45:40 -04:00
Michael S. Molina
fc857d987b fix: Unable to parse escaped tables (#30560) 2024-10-09 13:25:44 -03:00
Beto Dealmeida
cc9fd88c0d chore: improve DML check (#30417) 2024-09-27 15:26:36 -04:00
Beto Dealmeida
bdf29cb7c2 chore: organize SQL parsing files (#30258) 2024-09-13 16:24:19 -04:00