Re: [PR] fix(sql): guard FORCE_LIMIT against SHOW statements (#36939) [superset]

["codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>]

codeant-ai-for-open-source[bot] commented on code in PR #42588:
URL: https://github.com/apache/superset/pull/42588#discussion_r3679225741


##########
superset/sql/parse.py:
##########
@@ -1274,6 +1274,13 @@ def set_limit_value(
         Modify the `LIMIT` or `TOP` value of the SQL statement inplace.
         """
         if method == LimitMethod.FORCE_LIMIT:
+            # `SHOW` statements (`SHOW TABLES`, `SHOW DATABASES`, `SHOW CREATE
+            # TABLE`, etc.) have no real `LIMIT` slot in sqlglot's expression
+            # tree: setting `args["limit"]` doesn't get rejected, it renders a
+            # malformed statement with two `LIMIT` keywords, which engines
+            # like StarRocks reject outright. Leave them untouched.
+            if isinstance(self._parsed, exp.Show):
+                return

Review Comment:
   **Suggestion:** Returning without recording or applying an alternate fetch limit leaves `SHOW` results unbounded. SQL Lab passes `query.limit + 1` to `fetch_data`, but FORCE_LIMIT engine specs use `fetchall()` regardless of that argument, and the executor does not pass a fetch limit at all. Consequently, large `SHOW TABLES` or `SHOW DATABASES` results can be fully materialized in memory instead of being capped. Route these statements through a bounded fetch path or otherwise preserve the configured row-limit contract when SQL-level limiting is unsupported. [performance]
   
   <details>
   <summary><b>Severity Level:</b> Major ⚠️</summary>
   
   ```mdx
   - ⚠️ SQL Lab SHOW results bypass SQL-level row limiting.
   - ⚠️ Large metadata responses are fully materialized.
   - ⚠️ Database and worker memory usage can increase.
   ```
   </details>
   
   [![Fix in Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=5086bf9ba1f34a11a1824fb854bf6b8a&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [![Fix in VSCode Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=5086bf9ba1f34a11a1824fb854bf6b8a&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   
   *(Use Cmd/Ctrl + Click for best experience)*
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** superset/sql/parse.py
   **Line:** 1282:1283
   **Comment:**
   	*Performance: Returning without recording or applying an alternate fetch limit leaves `SHOW` results unbounded. SQL Lab passes `query.limit + 1` to `fetch_data`, but FORCE_LIMIT engine specs use `fetchall()` regardless of that argument, and the executor does not pass a fetch limit at all. Consequently, large `SHOW TABLES` or `SHOW DATABASES` results can be fully materialized in memory instead of being capped. Route these statements through a bounded fetch path or otherwise preserve the configured row-limit contract when SQL-level limiting is unsupported.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42588&comment_hash=09f6bcd5b25b7c94471768b3c4cb0113dae5564145b7b4d3c3fd1d4ae96b9edb&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42588&comment_hash=09f6bcd5b25b7c94471768b3c4cb0113dae5564145b7b4d3c3fd1d4ae96b9edb&reaction=dislike'>👎</a>



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org