You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "wuqicyber (via GitHub)" <gi...@apache.org> on 2025/05/26 06:45:07 UTC
[PR] fix(sql_parse): correctly handle undefined Jinja macros during table extraction [superset]
wuqicyber opened a new pull request, #33580:
URL: https://github.com/apache/superset/pull/33580
### SUMMARY
This patch addresses Issue #33579, where Jinja-templated queries that invoke Superset macros
(like `filter_values()`) would fail the permission-check phase with an
`UndefinedError` (and thus `QueryIsForbiddenToAccessException`). By
rendering the template with Superset’s `JinjaTemplateProcessor` (configured
with `DebugUndefined`)—or by catching `UndefinedError` and falling back to
that processor—the change ensures that all macros resolve gracefully,
allowing static table extraction to succeed.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Before:
<img width="1498" alt="image" src="https://github.com/user-attachments/assets/7853e7c0-0bb6-4cfe-b088-2931490aba22" />
After:
### TESTING INSTRUCTIONS
1. Enable Jinja templating: set `ENABLE_TEMPLATE_PROCESSING = True` in
your `superset_config.py`.
2. Ensure a user has only datasource access (no raw SQL access) to table like `video_game_sales`.
3. As that user, run:
```sql
WITH calculation AS (
SELECT count(*), genre
FROM video_game_sales
WHERE genre IN ({{ "'" + "','".join(filter_values('genre')) + "'" }})
GROUP BY genre
)
SELECT * FROM calculation;
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sql_parse): correctly handle undefined Jinja macros during table extraction [superset]
Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on PR #33580:
URL: https://github.com/apache/superset/pull/33580#issuecomment-2909939762
Hello and thanks for your contribution! Pythonically speaking, underscore-prefixed attribute means it's for internal usage and expose the context to outside world may have unexpected security implications.
Can you foresee a different way to tackle the problem?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sql_parse): correctly handle undefined Jinja macros during table extraction [superset]
Posted by "betodealmeida (via GitHub)" <gi...@apache.org>.
betodealmeida closed pull request #33580: fix(sql_parse): correctly handle undefined Jinja macros during table extraction
URL: https://github.com/apache/superset/pull/33580
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sql_parse): correctly handle undefined Jinja macros during table extraction [superset]
Posted by "wuqicyber (via GitHub)" <gi...@apache.org>.
wuqicyber commented on PR #33580:
URL: https://github.com/apache/superset/pull/33580#issuecomment-2911436380
> Hello and thanks for your contribution! Pythonically speaking, underscore-prefixed attribute means it's for internal usage and expose the context to outside world may have unexpected security implications.
>
> Can you foresee a different way to tackle the problem?
Hello and thank you for the feedback! You're absolutely right about the security implications of exposing underscore-prefixed attributes.
I've implemented a cleaner solution that uses Jinja2's built-in undefined handling mechanism instead of accessing private attributes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sql_parse): correctly handle undefined Jinja macros during table extraction [superset]
Posted by "betodealmeida (via GitHub)" <gi...@apache.org>.
betodealmeida commented on PR #33580:
URL: https://github.com/apache/superset/pull/33580#issuecomment-2912935481
@wuqicyber thank for the contribution, but we're currently phasing out `sql_parse` (see [SIP-117](https://github.com/apache/superset/issues/26786)).
I have a fix in my PRs for SIP-117 here:
https://github.com/apache/superset/pull/33568/files#diff-262aba4d8ec94601953bb91e7d86568f6c195458a56bee5e43db098f81fb9087R1386-R1388
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org