You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "wuqicyber (via GitHub)" <gi...@apache.org> on 2026/01/28 12:31:58 UTC
[I] Unknown column used in orderby for SQL expression columns (server-side pagination) [superset]
wuqicyber opened a new issue, #37520:
URL: https://github.com/apache/superset/issues/37520
### Bug description
## Summary
When using server-side pagination in a table chart and attempting to sort by a custom SQL expression column (adhoc column), the API returns a 400 error:
<img width="583" height="144" alt="Image" src="https://github.com/user-attachments/assets/4aa5e2c0-76e7-468c-9113-7474459670e5" />
This issue only occurs with server-side pagination enabled, where sorting is handled by the backend rather than the frontend.
## Steps to Reproduce
1. Create a table chart with server-side pagination enabled
2. Add a custom SQL expression column:
<img width="736" height="497" alt="Image" src="https://github.com/user-attachments/assets/7a66c8c5-9d1e-462e-ae6e-c152c4fd2a75" />
3. Click on the adhoc column header to sort by it
4. The API receives an orderby clause referencing the adhoc column by its label:
{
"orderby": [["new_rank_name", false]]
}
5. API returns 400 error
### Screenshots/recordings
_No response_
### Superset version
master / latest-dev
### Python version
3.10
### Node version
18 or greater
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Unknown column used in orderby for SQL expression columns (server-side pagination) [superset]
Posted by "SBIN2010 (via GitHub)" <gi...@apache.org>.
SBIN2010 closed issue #37520: Unknown column used in orderby for SQL expression columns (server-side pagination)
URL: https://github.com/apache/superset/issues/37520
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Unknown column used in orderby for SQL expression columns (server-side pagination) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #37520:
URL: https://github.com/apache/superset/issues/37520#issuecomment-3811074985
<!-- Answer -->
This error happens because Superset now enforces strict backend validation for sorting: the ORDER BY clause must reference known columns or metrics, not freeform SQL or adhoc column labels. This change prevents SQL injection and data exfiltration, and only allows sorting by columns visible in the chart (columns, groupby, or metrics) [source](https://github.com/apache/superset/pull/37371).
Recent fixes in PR #35342 and #35482 (merged after October 2025) update how adhoc SQL expression columns are handled in ORDER BY clauses, so upgrading to the latest master/dev branch should resolve this issue [source](https://github.com/apache/superset/pull/35342) [source](https://github.com/apache/superset/pull/35482).
If you can't upgrade, there are no official workarounds to restore the old freeform SQL sorting. For complex sorting, create a calculated column or metric in your dataset and sort by that. For multi-field sorting, you can pre-sort data in your database, create a calculated column encoding your desired order, or modify the frontend to send all selected sort fields to the backend, but there’s no built-in UI support for this [source](https://github.com/apache/superset/issues/35279#issuecomment-3332760718).
Let me know if you need more technical details or code references!
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/f607081c-7651-4bef-a97d-5268e97d5322?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/f607081c-7651-4bef-a97d-5268e97d5322?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/f607081c-7651-4bef-a97d-5268e97d5322?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/f607081c-7651-4bef-a97d-5268e97d5322?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/f607081c-7651-4bef-a97d-5268e97d5322?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/f607081c-7651-4bef-a97d-5268e97d5322?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/f607081c-7651-4bef-a97d-5268e97d5322?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=This%20error%20happens%20because%20Superset%20now%20enforces%20strict%20backend%20validation%20for%20sorting%3A%20the%20ORDER%20BY%20clause%20must%20reference%20known%20columns%20or%20metrics%2C%20not%20freeform%20SQL%20or%20adhoc%20column%20labels.%20This%20change%20prevents%20SQL%20injection%20and%20data%20exfiltration%2C%20and%20only%20allows%20sorting%20by%20columns%20visible%20in%20the%20chart%20%28columns%2C%20groupby%2C%20or%20metrics%29%20%5Bsource%5D%28https%3A//github.com/apache/superset/pull/37371%29.%0A%0ARecent%20fixes%20in%20PR%20%2335342%20and%20%2335482%20%28merged%20after%20October%202025%29%20update%20how%20adhoc%20SQL%20expression%20columns%20are%20handled%20in%20ORDER%20BY%20clauses%2C%20so%20upgrading%20to%20the%20latest%20mast
er/dev%20branch%20should%20resolve%20this%20issue%20%5Bsource%5D%28https%3A//github.com/apache/superset/pull/35342%29%20%5Bsource%5D%28https%3A//github.com/apache/superset/pull/35482%29.%0A%0AIf%20you%20can%27t%20upgrade%2C%20there%20are%20no%20official%20workarounds%20to%20restore%20the%20old%20freeform%20SQL%20sorting.%20For%20complex%20sorting%2C%20create%20a%20calculated%20column%20or%20metric%20in%20your%20dataset%20and%20sort%20by%20that.%20For%20multi-field%20sorting%2C%20you%20can%20pre-sort%20data%20in%20your%20database%2C%20create%20a%20calculated%20column%20encoding%20your%20desired%20order%2C%20or%20modify%20the%20frontend%20to%20send%20all%20selected%20sort%20fields%20to%20the%20backend%2C%20but%20there%E2%80%99s%20no%20built-in%20UI%20support%20for%20this%20%5Bsource%5D%28https%3A//github.com/apache/superset/issues/35279%23issuecomment-3332760718%29.%0A%0ALet%20me%20know%20if%20you%20need%20more%20technical%20details%20or%20code%20references%21) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/37520)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org