You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by dp...@apache.org on 2026/05/15 11:04:42 UTC
(superset) branch master updated: fix(database): extend shillelagh URI pattern to cover all driver variants (#39995)
This is an automated email from the ASF dual-hosted git repository.
dpgaspar pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git
The following commit(s) were added to refs/heads/master by this push:
new 407321e3943 fix(database): extend shillelagh URI pattern to cover all driver variants (#39995)
407321e3943 is described below
commit 407321e39434501ad74969e3f1520514382705ec
Author: Shaitan <10...@users.noreply.github.com>
AuthorDate: Fri May 15 12:04:34 2026 +0100
fix(database): extend shillelagh URI pattern to cover all driver variants (#39995)
Co-authored-by: Claude Sonnet 4.6 <no...@anthropic.com>
---
superset/security/analytics_db_safety.py | 3 +--
.../security/analytics_db_safety_tests.py | 25 +++++++++++++++++++---
2 files changed, 23 insertions(+), 5 deletions(-)
diff --git a/superset/security/analytics_db_safety.py b/superset/security/analytics_db_safety.py
index 73db564c60f..9af12d9b777 100644
--- a/superset/security/analytics_db_safety.py
+++ b/superset/security/analytics_db_safety.py
@@ -29,8 +29,7 @@ BLOCKLIST = {
# sqlite creates a local DB, which allows mapping server's filesystem
re.compile(r"sqlite(?:\+[^\s]*)?$"),
# shillelagh allows opening local files (eg, 'SELECT * FROM "csv:///etc/passwd"')
- re.compile(r"shillelagh$"),
- re.compile(r"shillelagh\+apsw$"),
+ re.compile(r"shillelagh(?:\+[^\s]*)?$"),
}
diff --git a/tests/integration_tests/security/analytics_db_safety_tests.py b/tests/integration_tests/security/analytics_db_safety_tests.py
index a9303dda61b..70f9104e3e7 100644
--- a/tests/integration_tests/security/analytics_db_safety_tests.py
+++ b/tests/integration_tests/security/analytics_db_safety_tests.py
@@ -72,11 +72,30 @@ from superset.security.analytics_db_safety import check_sqlalchemy_uri
True,
"shillelagh cannot be used as a data source for security reasons.",
),
- ("shillelagh+:///home/superset/bad.db", False, None),
+ (
+ "shillelagh+:///home/superset/bad.db",
+ True,
+ "shillelagh cannot be used as a data source for security reasons.",
+ ),
(
"shillelagh+something:///home/superset/bad.db",
- False,
- None,
+ True,
+ "shillelagh cannot be used as a data source for security reasons.",
+ ),
+ (
+ "shillelagh+csv:///etc/passwd",
+ True,
+ "shillelagh cannot be used as a data source for security reasons.",
+ ),
+ (
+ "shillelagh+json:///etc/passwd",
+ True,
+ "shillelagh cannot be used as a data source for security reasons.",
+ ),
+ (
+ "shillelagh+gsheets:///",
+ True,
+ "shillelagh cannot be used as a data source for security reasons.",
),
],
)