Amin Ghadersohi b5cbbe86b7 fix(security): Add table blocklist and fix MCP SQL validation bypass (#37411) ...

(cherry picked from commit 15b3c96f8e)

2026-02-10 16:21:57 -08:00

..

advanced_data_type

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

annotation_layers

chore: set up ruff as a new linter/formatter (#28158)

2024-04-24 17:19:53 -07:00

async_events

chore(GAQ): Remove GLOBAL_ASYNC_QUERIES_REDIS_CONFIG (#30284)

2025-01-21 20:03:00 -08:00

charts

fix: store form_data as dict during viz type migration (#36680)

2026-01-26 12:40:50 -08:00

columns

chore: remove sl_ tables (#28704)

2024-05-29 19:04:37 -07:00

commands

chore: cleanup ssh tunnel (#34388)

2026-01-26 12:40:49 -08:00

common

feat: Dynamic currency (#36416)

2026-01-26 12:40:52 -08:00

connectors

fix(dashboard): catch DatasourceNotFound in get_datasets to prevent 404 (#37503)

2026-01-30 12:17:18 -08:00

dao

feat: Add BaseDAO improvements and test reorganization (#35018)

2026-01-26 12:40:43 -08:00

daos

feat(theming): add base theme config (#35220)

2026-01-26 12:40:44 -08:00

dashboards

fix(dashboard): import with overwrite flag replaces charts instead of merging (#36551)

2025-12-17 11:20:47 -08:00

databases

chore: cleanup ssh tunnel (#34388)

2026-01-26 12:40:49 -08:00

datasets

feat: Dynamic currency (#36416)

2026-01-26 12:40:52 -08:00

datasource

feat(api): dataset read API uuid support (#34836)

2026-01-26 12:40:41 -08:00

db_engine_specs

fix(redshift): normalize table names to lowercase for CSV uploads (#37019)

2026-02-02 16:28:49 -08:00

distributed_lock

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

explore

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

extensions

feat(docker): Add pytest support to docker-compose-light.yml (#34373)

2025-08-06 00:17:50 -04:00

fixtures

fix(dev/ci): pre-commit fixes galore (#32352)

2025-02-24 11:26:45 -07:00

importexport

feat: Implement sparse import for ImportAssetsCommand (#32670)

2025-03-17 08:44:15 -06:00

key_value

feat: add option for hash algorithms (#35621)

2026-01-26 12:40:50 -08:00

mcp_service

fix(mcp): remove html.escape to fix ampersand display in chart titles (#37186)

2026-02-06 09:30:51 -05:00

migrations

chore: proper current_app.config proxy usage (#34345)

2025-07-31 19:27:42 -07:00

models

fix: DB OAuth2 fixes (#37350)

2026-01-26 12:40:53 -08:00

pandas_postprocessing

fix(histogram): add NULL handling for histogram (#35693)

2025-11-14 13:58:38 -08:00

queries

fix: cache key generation (#36225)

2026-01-26 12:40:48 -08:00

reports

feat: Add Dashboard Filter Support for Alert Reports (#32196)

2026-01-26 12:40:43 -08:00

scripts

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

security

fix(dashboard): Prevent fatal error when database connection is unavailable (#37576)

2026-02-09 09:27:25 -08:00

sql

fix(security): Add table blocklist and fix MCP SQL validation bypass (#37411)

2026-02-10 16:21:57 -08:00

tables

chore: remove sl_ tables (#28704)

2024-05-29 19:04:37 -07:00

tags

fix(tags): ensure tag creation is compatible with MySQL by avoiding Markup objects (#36075)

2025-11-18 10:49:04 -08:00

tasks

fix: Implement SIP-40 error styles for GAQ (#36596)

2026-01-16 16:03:45 -08:00

themes

feat(theming): add per-theme custom font URL support (#36317)

2026-01-26 12:40:50 -08:00

thumbnails

feat: add option for hash algorithms (#35621)

2026-01-26 12:40:50 -08:00

utils

feat(cache): use configurable hash algorithm for flask-caching (#37361)

2026-01-26 12:40:53 -08:00

views

fix(theme): migrate APP_NAME to brandAppName theme token with backward compatibility (#37370)

2026-01-26 12:40:53 -08:00

__init__.py

…

config_test.py

chore: proper current_app.config proxy usage (#34345)

2025-07-31 19:27:42 -07:00

conftest.py

fix: Bump FAB to 5.X (#33055)

2025-09-12 17:07:53 -07:00

core_tests.py

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

dataframe_test.py

fix(api): nan is not properly handled for athena connections (#37071)

2026-01-22 11:07:10 -08:00

extension_tests.py

feat(ui): Adding manifest prefix config (#19141)

2022-03-17 08:58:48 -07:00

feature_flag_test.py

chore: s/MockFixture/MockerFixture/g (#29160)

2024-06-10 12:35:07 -04:00

initialization_test.py

fix: Check migration status before initializing database-dependent features (#34679)

2025-08-21 14:05:27 -07:00

jinja_context_test.py

fix: handle undefined template variables safely in query rendering. (#35009)

2026-01-07 10:54:23 -08:00

legacy_tests.py

chore: set up ruff as a new linter/formatter (#28158)

2024-04-24 17:19:53 -07:00

result_set_test.py

fix: customize column description limit size in db_engine_spec (#34808)

2025-08-23 11:16:43 -07:00

sql_lab_execution_context.py

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

sql_lab_test.py

refactor(db-engine-specs): use standard OAuth 2.0 params in base class (#37010)

2026-01-26 12:40:51 -08:00