You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by en...@apache.org on 2026/09/04 13:32:14 UTC
(superset) branch enxdev/fix/sqllab-export-jinja-400 created (now 92090e0f330)
This is an automated email from the ASF dual-hosted git repository.
EnxDev pushed a change to branch enxdev/fix/sqllab-export-jinja-400
in repository https://gitbox.apache.org/repos/asf/superset.git
at 92090e0f330 fix(sql_lab): raise 400 not 500 on malformed Jinja during CSV export access check
This branch includes the following new commits:
new 92090e0f330 fix(sql_lab): raise 400 not 500 on malformed Jinja during CSV export access check
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(superset) 01/01: fix(sql_lab): raise 400 not 500 on malformed Jinja during CSV export access check
Posted by en...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
EnxDev pushed a commit to branch enxdev/fix/sqllab-export-jinja-400
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 92090e0f330adad9f2e1f8b5b8efca8bead29498
Author: Enzo Martellucci <en...@gmail.com>
AuthorDate: Fri Sep 4 15:24:43 2026 +0200
fix(sql_lab): raise 400 not 500 on malformed Jinja during CSV export access check
SqlResultExportCommand.validate() only caught SupersetSecurityException
around raise_for_access(), so a raw jinja2 TemplateError from re-parsing
unrendered Jinja surfaced as an opaque 500. Sibling call sites already
guard this with except TemplateError; this brings export.py in line.
Co-Authored-By: Claude Sonnet 5 <no...@anthropic.com>
---
superset/commands/sql_lab/export.py | 10 ++++++++++
tests/integration_tests/sql_lab/commands_tests.py | 22 ++++++++++++++++++++++
2 files changed, 32 insertions(+)
diff --git a/superset/commands/sql_lab/export.py b/superset/commands/sql_lab/export.py
index e488bf0a3ae..93aea9d58c6 100644
--- a/superset/commands/sql_lab/export.py
+++ b/superset/commands/sql_lab/export.py
@@ -22,6 +22,7 @@ from typing import Any, cast, TypedDict
import pandas as pd
from flask import current_app as app
from flask_babel import gettext as __
+from jinja2.exceptions import TemplateError
from superset import db, results_backend, results_backend_use_msgpack
from superset.commands.base import BaseCommand
@@ -80,6 +81,15 @@ class SqlResultExportCommand(BaseCommand):
),
status=403,
) from ex
+ except TemplateError as ex:
+ raise SupersetErrorException(
+ SupersetError(
+ message=str(ex),
+ error_type=SupersetErrorType.GENERIC_COMMAND_ERROR,
+ level=ErrorLevel.ERROR,
+ ),
+ status=400,
+ ) from ex
def run(
self,
diff --git a/tests/integration_tests/sql_lab/commands_tests.py b/tests/integration_tests/sql_lab/commands_tests.py
index 11db302ac56..cb737cbda1f 100644
--- a/tests/integration_tests/sql_lab/commands_tests.py
+++ b/tests/integration_tests/sql_lab/commands_tests.py
@@ -211,6 +211,28 @@ class TestSqlResultExportCommand(SupersetTestCase):
== SupersetErrorType.QUERY_SECURITY_ACCESS_ERROR
)
+ @pytest.mark.usefixtures("create_database_and_query")
+ def test_validation_malformed_jinja(self) -> None:
+ # ``raise_for_access`` re-parses the query's unrendered Jinja via
+ # ``process_jinja_sql`` and can raise a raw ``TemplateError`` (e.g. an
+ # unclosed ``{% if %}``). ``TemplateSyntaxError`` is a subclass of
+ # ``TemplateError``. It must surface as a 400, not an opaque 500.
+ assert issubclass(TemplateSyntaxError, TemplateError)
+
+ command = export.SqlResultExportCommand("test")
+
+ with mock.patch(
+ "superset.models.sql_lab.Query.raise_for_access",
+ side_effect=TemplateSyntaxError("unexpected end of template", lineno=1),
+ ):
+ with pytest.raises(SupersetErrorException) as ex_info:
+ command.run()
+ assert (
+ ex_info.value.error.error_type
+ == SupersetErrorType.GENERIC_COMMAND_ERROR
+ )
+ assert ex_info.value.status == 400
+
@pytest.mark.usefixtures("create_database_and_query")
@patch("superset.models.sql_lab.Query.raise_for_access", lambda _: None)
@patch("superset.models.core.Database.get_df")