You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "sha174n (via GitHub)" <gi...@apache.org> on 2026/08/11 11:14:01 UTC
[PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
sha174n opened a new pull request, #43060:
URL: https://github.com/apache/superset/pull/43060
`PostgresEngineSpec.get_default_schema_for_query` rejects a query that rebinds the session `search_path`, because a changed search_path alters how unqualified table references resolve. It previously matched only the structured `SET search_path = ...` form (via `get_settings`), and missed the equivalent `set_config('search_path', ...)` function-call form (and other variants).
This switches the guard to `changes_search_path()`, which already recognises the `SET`, `set_config`, and exotic forms in one place. Adds a regression test for the `set_config` form.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5398573638
Code looks solid, fail-closed on an ambiguous `set_config` name is the right call, and the non-literal / opaque DO-block cases are both covered with real tests. Only thing blocking is GitHub shows conflicts with `master` now, needs a rebase before this can merge.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on code in PR #43060:
URL: https://github.com/apache/superset/pull/43060#discussion_r3758313549
##########
superset/db_engine_specs/postgres.py:
##########
@@ -645,8 +645,13 @@ def get_default_schema_for_query(
malicious path setting in the query.
"""
script = process_jinja_sql(query.sql, database, template_params).script
- settings = script.get_settings()
- if "search_path" in settings:
+ # A query can rebind the session ``search_path`` not only via a
+ # structured ``SET search_path = ...`` (surfaced by ``get_settings``)
+ # but also via the ``set_config('search_path', ...)`` function and other
+ # forms. ``changes_search_path`` recognises all of them; matching on
+ # ``get_settings`` alone missed the function-call form, which changes how
+ # unqualified table references resolve at runtime.
+ if any(statement.changes_search_path() for statement in script.statements):
Review Comment:
Fixed in 6498b9a4a4: a non-literal `set_config` setting name (e.g. `set_config('search_' || 'path', ...)`) is now treated as a rebind, since it can't be resolved statically. Same for a `set_config` inside a statement the parser leaves opaque, such as a PL/pgSQL `DO` block. Covered by new cases in `test_changes_search_path`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5608901437
Pushed ab9f341b77, with current master merged in again. CI was red on the 100% coverage gate for `superset/sql/`: the fail-closed branches for an `EXPLAIN ANALYZE` body that cannot be classified had no test of their own, so they are covered now.
Same commit de-duplicates the helpers that grew out of the earlier rounds: the `EXPLAIN ANALYZE` body classification is now shared between `is_mutating` and `changes_search_path` rather than copied into each, and the opaque-`SET` leading-setting-name scan is shared between `changes_search_path` and `changes_default_schema`. Also folded the parenthesized and bare spellings of the option list into one flag search, and dropped the `noqa: C901` on `is_mutating` that the extraction made unnecessary.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5604203617
Pushed b494042da1 as a follow-up: the opaque-statement fallback now matches a nested `SET search_path` as well as `set_config`, and only applies to commands whose body is another statement (`DO`/`CALL`/`EXECUTE`/`PREPARE`), so `VACUUM` / `EXPLAIN ANALYZE` / `SHOW search_path` are no longer text-matched. Also dropped a now-redundant check in `changes_default_schema` and an unused script-level helper.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5252445978
<!-- Bito Reply -->
The flagged security issue is valid. The current implementation in `superset/db_engine_specs/postgres.py` relies on `changes_search_path()`, which correctly identifies various ways to change the search path, including `set_config` function calls. The provided PR diff already implements this fix by replacing the limited `get_settings()` check with a more robust check using `any(statement.changes_search_path() for statement in script.statements)`. This ensures that even if `set_config` uses expressions or dynamic arguments, the security gate will correctly identify and block the attempt to modify the search path.
**superset/db_engine_specs/postgres.py**
```
# A query can rebind the session ``search_path`` not only via a
# structured ``SET search_path = ...`` (surfaced by ``get_settings``)
# but also via the ``set_config('search_path', ...)`` function and other
# forms. ``changes_search_path`` recognises all of them; matching on
# ``get_settings`` alone missed the function-call form, which changes how
# unqualified table references resolve at runtime.
if any(statement.changes_search_path() for statement in script.statements):
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #43060:
URL: https://github.com/apache/superset/pull/43060#discussion_r3757456841
##########
superset/db_engine_specs/postgres.py:
##########
@@ -645,8 +645,13 @@ def get_default_schema_for_query(
malicious path setting in the query.
"""
script = process_jinja_sql(query.sql, database, template_params).script
- settings = script.get_settings()
- if "search_path" in settings:
+ # A query can rebind the session ``search_path`` not only via a
+ # structured ``SET search_path = ...`` (surfaced by ``get_settings``)
+ # but also via the ``set_config('search_path', ...)`` function and other
+ # forms. ``changes_search_path`` recognises all of them; matching on
+ # ``get_settings`` alone missed the function-call form, which changes how
+ # unqualified table references resolve at runtime.
+ if any(statement.changes_search_path() for statement in script.statements):
Review Comment:
**Suggestion:** The security gate delegates entirely to `changes_search_path()`, but that helper only recognizes `set_config` when its first argument is the literal `search_path`. PostgreSQL accepts expressions for the setting name, so a query such as `set_config('search_' || 'path', 'other_schema', false)` changes the session search path while this check returns false, allowing schema resolution to proceed with an attacker-controlled path. Update the detection to handle expression-valued setting names or conservatively reject non-literal `set_config` setting names. [security]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ PostgreSQL schema authorization can be bypassed through dynamic `set_config` names.
- ❌ Unqualified tables may resolve in attacker-selected schemas.
- ⚠️ SQL Lab denylist and RLS checks can use the wrong schema.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=595c357b5853454ca3246b7c2d39cb7c&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=595c357b5853454ca3246b7c2d39cb7c&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/db_engine_specs/postgres.py
**Line:** 654:654
**Comment:**
*Security: The security gate delegates entirely to `changes_search_path()`, but that helper only recognizes `set_config` when its first argument is the literal `search_path`. PostgreSQL accepts expressions for the setting name, so a query such as `set_config('search_' || 'path', 'other_schema', false)` changes the session search path while this check returns false, allowing schema resolution to proceed with an attacker-controlled path. Update the detection to handle expression-valued setting names or conservatively reject non-literal `set_config` setting names.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43060&comment_hash=fc3caf0e72086a9a5cba8d59974857f8ba977bcaeacb7dd94e0fce6a614d33dc&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43060&comment_hash=fc3caf0e72086a9a5cba8d59974857f8ba977bcaeacb7dd94e0fce6a614d33dc&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5607886024
Pushed 808f3b3774. `EXPLAIN ANALYZE <statement>` runs its body for real, so a `search_path` rebind inside one takes effect even though sqlglot keeps the tail as opaque text. `is_mutating` already normalized that tail and recursed into it, so I factored it out as `_explain_analyze_body` and reused it from `changes_search_path` rather than text-matching. Re-parsing keeps it precise: `EXPLAIN ANALYZE SELECT * FROM search_path_audit` stays false.
Same commit also accepts a flag with no trailing whitespace (Postgres takes `EXPLAIN ANALYZE(...)`), matches the procedural-body fallback on whole words so `reset_config` is not mistaken for `set_config`, and derives `_MUTATING_COMMAND_NAMES` from the nested-body heads instead of repeating them. New cases in `test_changes_search_path` and `test_is_mutating_fails_closed_on_gate_blind_spots`; still mergeable with master.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5255896955
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5252400500
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5604229981
### <span aria-hidden="true">👷</span> Deploy Preview for *superset-docs-preview* processing.
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | b494042da19d5c3ed3c490f38dd2c20749898e33 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6aa177a1012ffc00087d69ae |
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5602478871
Thanks! Conflicts are cleared now, current master is merged in and GitHub shows it mergeable again. Good for another look whenever you have a moment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5634950158
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers an incremental AI Review.
- `/review full` - Manually triggers a full AI Review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5617399749
Pushed cc908d292c, with current master merged in. Two cleanups from another pass over the diff: the setting-name normalization that was inlined in three places is now one helper, and `changes_search_path` no longer repeats the opaque-`SET` guard that helper already performs.
`changes_default_schema` also matches a `SET SCHEMA` / `SET CATALOG` carried in a body the parser leaves opaque, which `SET search_path` in the same body was already matched on. The `SET` head is required there, so a body that merely creates or references a schema is unaffected. New cases in `test_changes_default_schema`; `superset/sql/` still at 100% coverage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5252450631
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/43060?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `0%` with `1 line` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 57.27%. Comparing base ([`5ee2793`](https://app.codecov.io/gh/apache/superset/commit/5ee279363ca78372fa21eae1c73f4e72cb5718e5?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`91c5c99`](https://app.codecov.io/gh/apache/superset/commit/91c5c9963aacd85110d777e065d4166b024443e0?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/43060?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [superset/db\_engine\_specs/postgres.py](https://app.codecov.io/gh/apache/superset/pull/43060?src=pr&el=tree&filepath=superset%2Fdb_engine_specs%2Fpostgres.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvZGJfZW5naW5lX3NwZWNzL3Bvc3RncmVzLnB5) | 0.00% | [1 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/43060?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
> :exclamation: There is a different number of reports uploaded between BASE (5ee2793) and HEAD (91c5c99). Click for more details.
>
> <details><summary>HEAD has 57 uploads less than BASE</summary>
>
>| Flag | BASE (5ee2793) | HEAD (91c5c99) |
>|------|------|------|
>|python|45|2|
>|presto|8|1|
>|hive|8|1|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #43060 +/- ##
==========================================
- Coverage 66.55% 57.27% -9.28%
==========================================
Files 2864 2864
Lines 161894 161893 -1
Branches 37305 37305
==========================================
- Hits 107742 92725 -15017
- Misses 52106 68307 +16201
+ Partials 2046 861 -1185
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/43060/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/43060/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `38.15% <0.00%> (+<0.01%)` | :arrow_up: |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/43060/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/43060/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/43060/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `40.11% <0.00%> (+<0.01%)` | :arrow_up: |
| [python](https://app.codecov.io/gh/apache/superset/pull/43060/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `40.17% <0.00%> (-18.96%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/43060/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/43060/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/43060?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #43060:
URL: https://github.com/apache/superset/pull/43060
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(postgres): detect search_path changes via set_config, not only SET [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on PR #43060:
URL: https://github.com/apache/superset/pull/43060#issuecomment-5617843971
Pushed 441d31241f, with current master merged in. Another pass over the diff: the isinstance / head-keyword / body-text triple that each gate spelled out for itself is now two shared accessors (`_command_head`, `_nested_body_text`), so a gate can't quietly opt out of a branch by omitting the case fold.
Three behaviour changes fell out of that:
- a nested body matches a qualifier between `SET` and the setting name (`SET LOCAL SCHEMA 'x'`), as the non-nested path already did;
- `RESET search_path` / `RESET ALL` count as a rebind, since the restored default need not be the schema the caller selected;
- `changes_default_schema` recurses through an `EXPLAIN ANALYZE` wrapper rather than deferring to `changes_search_path`, so its own `SET SCHEMA` / `SET CATALOG` forms are visible inside one.
New cases for each in `test_changes_search_path` and `test_changes_default_schema`; `superset/sql/` still at 100% coverage. The one red check on the previous commit was `playwright-tests-experimental`, which timed out fetching `uv` in its Setup Python step, before any test ran.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org