(superset) 01/01: fix: sqlparse ReDOS

[be...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

beto pushed a commit to branch fix-redos
in repository https://gitbox.apache.org/repos/asf/superset.git

commit efcb32b27e20ad486eaf00ea02b9fb5cb7903976
Author: Beto Dealmeida <ro...@dealmeida.net>
AuthorDate: Wed Jul 30 16:54:59 2025 -0400

    fix: sqlparse ReDOS
---
 superset/sql_parse.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/superset/sql_parse.py b/superset/sql_parse.py
index e82e88ea75..7dd6db8284 100644
--- a/superset/sql_parse.py
+++ b/superset/sql_parse.py
@@ -88,7 +88,7 @@ logger = logging.getLogger(__name__)
 # reference: https://sqlparse.readthedocs.io/en/stable/extending/
 lex = Lexer.get_default_instance()
 sqlparser_sql_regex = keywords.SQL_REGEX
-sqlparser_sql_regex.insert(25, (r"'(''|\\\\|\\|[^'])*'", sqlparse.tokens.String.Single))
+sqlparser_sql_regex.insert(25, (r"'(?:[^'\\]|\\.|'')*'", sqlparse.tokens.String.Single))
 lex.set_SQL_REGEX(sqlparser_sql_regex)