You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "eschutho (via GitHub)" <gi...@apache.org> on 2026/09/11 16:42:19 UTC
[PR] fix(sqla): guard unprotected Jinja template rendering in ExploreMixin [superset]
eschutho opened a new pull request, #44172:
URL: https://github.com/apache/superset/pull/44172
### SUMMARY
Two `process_template` call sites in `ExploreMixin` — `get_timestamp_expression()` and `convert_tbl_column_to_sqla_col()` — lack exception handling for Jinja template errors. When a user writes a Jinja expression (e.g. `{{ filter_values('col')[0] }}` or `{{ undefined_var.attr }}`) in a time column or calculated column, and the template raises `UndefinedError` or `TemplateError`, the raw jinja2 exception escapes unhandled instead of being surfaced as a `QueryObjectValidationError`.
This is the same bug class fixed by #42366 and proposed in #42401 for `get_rendered_sql()`, which already has the correct two-clause exception handler. These two sibling methods in the same class were missed.
**Root cause**: `BaseTemplateProcessor.process_template` only catches `RecursionError` and a narrow pattern-matched `UndefinedError`; all other `UndefinedError` variants and any `TemplateError`/`TemplateSyntaxError` escape raw. Both methods are called from `get_sqla_query()` (the main chart-rendering / SQL Lab query path) with no upstream catch.
**Fix**: Wrap both `process_template` calls with the same two-clause handler (`except UndefinedError` → `QueryObjectValidationError`, then `except (TemplateError, SupersetSyntaxErrorException)` → `QueryObjectValidationError`), mirroring the existing pattern in `get_rendered_sql()`. All needed imports were already present in the file.
This is additive exception handling only — no behavior change for the success path.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — backend-only change affecting error handling, no UI changes.
### TESTING INSTRUCTIONS
1. Create a dataset with a calculated column expression containing `{{ undefined_var.attr }}`
2. Try to query/chart using that column
3. **Before**: raw `jinja2.exceptions.UndefinedError` escapes, producing an opaque 500 error
4. **After**: `QueryObjectValidationError` with message "Calculated column template error: 'undefined_var' is undefined" — a clean, user-facing error
Automated regression tests are included covering both `UndefinedError` and `TemplateSyntaxError` for both fixed methods.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqla): guard unprotected Jinja template rendering in ExploreMixin [superset]
Posted by "eschutho (via GitHub)" <gi...@apache.org>.
eschutho commented on PR #44172:
URL: https://github.com/apache/superset/pull/44172#issuecomment-5703820493
@rebenitez1802 thanks for the thorough pass — the High was a real gap (the mixin method I'd patched has no production caller). Pushed `c92265919732`:
**High** — reverted `ExploreMixin.get_timestamp_expression` back to unguarded (it's dead code, `TableColumn` doesn't subclass `ExploreMixin`) and moved the two-clause handler into `TableColumn.get_timestamp_expression` instead, which is the method every call site actually dispatches to. Retargeted its two tests off the `__get__`-bound mixin onto the real method via the existing `_stored_col` fixture helper.
**Medium** — added `SupersetTemplateException` to the caught tuple (with a `str(ex)` fallback) in the retargeted `get_timestamp_expression`, in `convert_tbl_column_to_sqla_col`, and in `get_rendered_sql` for consistency.
**Low (2 of 4)** — extended the identical guard to the two sibling `get_sqla_col` methods (`TableColumn.get_sqla_col`, `SqlMetric.get_sqla_col`) since they're the same shape as what I was already touching. Fixed the tests injecting a raw `TemplateSyntaxError` (which `process_template` always re-wraps as `SupersetSyntaxErrorException` before a caller ever sees it) to inject the real wrapped type instead. Tightened `match=` assertions to the interpolated message, not just the static prefix. Restored the `else: # SupersetSyntaxErrorException` disambiguator.
**Deliberately not done**, flagging rather than guessing at scope: the adhoc-SQL sibling paths you flagged (`_process_metric_sql_expression`/`_process_validated_sql_expression`) have zero existing exception handling and sit on a much broader, `noqa: C901`-complex path with more collaborators — wrapping those felt like a separate, riskier change rather than a same-shape extension, so leaving it as a follow-up rather than bundling it here. Also skipped the handler-dedupe suggestion given your own pybabel-extraction caveat.
Full test file (92 tests) green, ruff/format clean, fail-before/pass-after verified individually for all 8 new/retargeted tests. Ready for another look.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqla): guard unprotected Jinja template rendering in ExploreMixin [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44172:
URL: https://github.com/apache/superset/pull/44172#issuecomment-5637665235
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqla): guard unprotected Jinja template rendering in ExploreMixin [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #44172:
URL: https://github.com/apache/superset/pull/44172#issuecomment-5637686098
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 7d4f27709be2cccc390dbc82ed3c6b278de0038a |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6aa42f6cb3116100086285df |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-44172--superset-docs-preview.netlify.app](https://deploy-preview-44172--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DctbCoAgEEDRvcx3gvaQaActY9IRC7PBJiiiveffhct5gcuxs8AE0MBSMLtYO6y3unJdQk7Iq23NGyqhnRMKqUiJqZxVeOJ0PLOvxiL2bbBu6YyxRms92nYcfIDvBw) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-44172--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqla): guard unprotected Jinja template rendering in ExploreMixin [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44172:
URL: https://github.com/apache/superset/pull/44172#issuecomment-5706229357
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers an incremental AI Review.
- `/review full` - Manually triggers a full AI Review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqla): guard unprotected Jinja template rendering in ExploreMixin [superset]
Posted by "eschutho (via GitHub)" <gi...@apache.org>.
eschutho merged PR #44172:
URL: https://github.com/apache/superset/pull/44172
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqla): guard unprotected Jinja template rendering in ExploreMixin [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #44172:
URL: https://github.com/apache/superset/pull/44172#issuecomment-5637729729
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/44172?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `0%` with `18 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 57.44%. Comparing base ([`774a511`](https://app.codecov.io/gh/apache/superset/commit/774a51124ed30e7095636bebcb32e95e388867ff?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`7d4f277`](https://app.codecov.io/gh/apache/superset/commit/7d4f27709be2cccc390dbc82ed3c6b278de0038a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/44172?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [superset/models/helpers.py](https://app.codecov.io/gh/apache/superset/pull/44172?src=pr&el=tree&filepath=superset%2Fmodels%2Fhelpers.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvbW9kZWxzL2hlbHBlcnMucHk=) | 0.00% | [18 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/44172?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
> :exclamation: There is a different number of reports uploaded between BASE (774a511) and HEAD (7d4f277). Click for more details.
>
> <details><summary>HEAD has 93 uploads less than BASE</summary>
>
>| Flag | BASE (774a511) | HEAD (7d4f277) |
>|------|------|------|
>|python|71|2|
>|presto|13|1|
>|hive|13|1|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #44172 +/- ##
===========================================
- Coverage 80.16% 57.44% -22.72%
===========================================
Files 2925 2925
Lines 172563 172579 +16
Branches 40058 40060 +2
===========================================
- Hits 138337 99142 -39195
- Misses 31629 72505 +40876
+ Partials 2597 932 -1665
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/44172/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/44172/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `37.33% <0.00%> (-0.01%)` | :arrow_down: |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/44172/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/44172/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/44172/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `39.22% <0.00%> (-0.01%)` | :arrow_down: |
| [python](https://app.codecov.io/gh/apache/superset/pull/44172/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `39.27% <0.00%> (-45.29%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/44172/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/44172/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/44172?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org