(superset) branch fix-dashboard-default-filters-decode-error created (now 0e36fa4c86c)

[el...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

eschutho pushed a change to branch fix-dashboard-default-filters-decode-error
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 0e36fa4c86c fix(dashboard): catch JSONDecodeError on malformed default_filters in set_dash_metadata

This branch includes the following new commits:

     new 0e36fa4c86c fix(dashboard): catch JSONDecodeError on malformed default_filters in set_dash_metadata

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(dashboard): catch JSONDecodeError on malformed default_filters in set_dash_metadata

[el...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

eschutho pushed a commit to branch fix-dashboard-default-filters-decode-error
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 0e36fa4c86ca03c0bf78b861da03f5e9103f4195
Author: Elizabeth Thompson <es...@gmail.com>
AuthorDate: Sat Sep 26 16:51:53 2026 +0000

    fix(dashboard): catch JSONDecodeError on malformed default_filters in set_dash_metadata
    
    DashboardJSONMetadataSchema.default_filters only validates that the value
    is a string, so a non-JSON string reaches DashboardDAO.set_dash_metadata
    via the dashboard create/update API and escapes as a raw JSONDecodeError
    (returned as a 500). Fall back to an empty dict, mirroring the existing
    idiom in DashboardDAO.update_native_filters_config.
    
    Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
---
 superset/daos/dashboard.py             |  7 +++++--
 tests/unit_tests/dao/dashboard_test.py | 23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/superset/daos/dashboard.py b/superset/daos/dashboard.py
index 6d323cd0717..c48f936eabf 100644
--- a/superset/daos/dashboard.py
+++ b/superset/daos/dashboard.py
@@ -322,7 +322,7 @@ class DashboardDAO(BaseDAO[Dashboard]):
         return True
 
     @staticmethod
-    def set_dash_metadata(
+    def set_dash_metadata(  # noqa: C901
         dashboard: Dashboard,
         data: dict[Any, Any],
         old_to_new_slice_ids: dict[int, int] | None = None,
@@ -413,7 +413,10 @@ class DashboardDAO(BaseDAO[Dashboard]):
                     else data["filter_scopes"],
                 )
 
-            default_filters_data = json.loads(data.get("default_filters", "{}"))
+            try:
+                default_filters_data = json.loads(data.get("default_filters", "{}"))
+            except (json.JSONDecodeError, TypeError):
+                default_filters_data = {}
             applicable_filters = {
                 key: v
                 for key, v in default_filters_data.items()
diff --git a/tests/unit_tests/dao/dashboard_test.py b/tests/unit_tests/dao/dashboard_test.py
index 830cb2feef8..48b617a1370 100644
--- a/tests/unit_tests/dao/dashboard_test.py
+++ b/tests/unit_tests/dao/dashboard_test.py
@@ -172,6 +172,29 @@ def test_set_dash_metadata_updates_refresh_frequency_when_present(
     )
 
 
+def test_set_dash_metadata_malformed_default_filters(session: Session) -> None:
+    """set_dash_metadata must not raise on a ``default_filters`` value that is
+    not valid JSON.
+
+    ``DashboardJSONMetadataSchema.default_filters`` only checks that the value
+    is a string, so malformed JSON reaches ``set_dash_metadata`` via the
+    dashboard create/update API and previously escaped as a raw
+    ``JSONDecodeError``.
+    """
+    Dashboard.metadata.create_all(session.get_bind())
+
+    dashboard = Dashboard(dashboard_title="malformed_default_filters_dash")
+    db.session.add(dashboard)
+    db.session.flush()
+
+    DashboardDAO.set_dash_metadata(
+        dashboard, {"positions": {}, "default_filters": "not-json"}
+    )
+
+    md = json.loads(dashboard.json_metadata)
+    assert md["default_filters"] == "{}"
+
+
 def _position_with_trapped_chart(
     placed_chart_id: int, trapped_chart_id: int
 ) -> dict[str, Any]: