You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/06/08 16:56:12 UTC
(superset) branch docs/jinja-get-filters-safe-example created (now 92352495395)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch docs/jinja-get-filters-safe-example
in repository https://gitbox.apache.org/repos/asf/superset.git
at 92352495395 docs(jinja): show a safe filter example in get_filters docstring
This branch includes the following new commits:
new 92352495395 docs(jinja): show a safe filter example in get_filters docstring
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(superset) 01/01: docs(jinja): show a safe filter example in get_filters docstring
Posted by ru...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch docs/jinja-get-filters-safe-example
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 923524953951cbdfa9ed3511928ea5eb9d2e8703
Author: Claude Code <no...@anthropic.com>
AuthorDate: Mon Jun 8 09:55:48 2026 -0700
docs(jinja): show a safe filter example in get_filters docstring
The get_filters docstring demonstrated building a LIKE clause by hand-escaping
the value with replace("'", "''"). That pattern is incomplete and easy to
misuse. Remove it from the example, keep the where_in-based IN example, and add
a warning against hand-escaping filter values into SQL.
Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
superset/jinja_context.py | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/superset/jinja_context.py b/superset/jinja_context.py
index 2a2e838708f..87d7e5c970e 100644
--- a/superset/jinja_context.py
+++ b/superset/jinja_context.py
@@ -354,6 +354,12 @@ class ExtraCache:
- you want to have the ability for filter inside the main query for speed
purposes
+ .. warning::
+ Do not hand-escape filter values into SQL strings (for example with
+ ``replace("'", "''")``). Such patterns are incomplete and easy to get
+ wrong. Render list values through the ``where_in`` filter, and prefer
+ the ``IN`` operator over building literals by hand.
+
Usage example::
@@ -375,10 +381,6 @@ class ExtraCache:
AND
full_name IN {{ filter.get('val')|where_in }}
{%- endif -%}
- {%- if filter.get('op') == 'LIKE' -%}
- AND
- full_name LIKE '{{ filter.get('val') | replace("'", "''") }}'
- {%- endif -%}
{%- endfor -%}
UNION ALL
SELECT