bito-code-review[bot] commented on code in PR #40398:
URL: https://github.com/apache/superset/pull/40398#discussion_r3293888344
##########
superset/mcp_service/chart/schemas.py:
##########
@@ -700,19 +700,41 @@ class ColumnRef(BaseModel):
"(use get_dataset_info to see available metrics). "
"When set, 'aggregate' is ignored.",
)
+ sql_expression: str | None = Field(
+ None,
+ max_length=2000,
+ description=(
+ "Inline SQL expression for a calculated metric, e.g. "
+ "'SUM(profit) / NULLIF(SUM(sales), 0)'. Use for ratios, "
+ "growth rates, conversion percentages, and other formulas "
+ "that don't reduce to a single column + aggregate. When set, "
+ "'aggregate' is ignored; 'name' is used as the metric label."
+ ),
Review Comment:
<div>
<div id="suggestion">
<div id="issue"><b>CWE-89: Unsanitized SQL Expression</b></div>
<div id="fix">
Add a Pydantic `@field_validator` for `sql_expression` that calls
`sanitize_user_input` with `check_sql_keywords=True`, matching the sanitization
applied to the `name` field. Place it immediately after the `sql_expression`
Field declaration. (See also:
[CWE-89](https://cwe.mitre.org/data/definitions/89.html))
</div>
</div>
<small><i>Code Review Run #090182</i></small>
</div>
---
Should Bito avoid suggestions like this for future reviews? (<a
href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
- [ ] Yes, avoid them
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
