rusackas opened a new pull request, #43345: URL: https://github.com/apache/superset/pull/43345
### SUMMARY Follow-up from a `codeant-ai-for-open-source` finding on #43337: the `post_processing` operation allowlist (`ChartDataPostProcessingOperationSchema.operation` in `superset/charts/schemas.py`, and the dispatch guard in `QueryObject.exec_post_processing`) accepts `escape_separator`/`unescape_separator` as valid operation names. Those are internal `str -> str` helpers used by `flatten`, not DataFrame post-processing operations — submitting one as an `operation` currently either raises a confusing `TypeError` (the function gets called with a DataFrame instead of a string) rather than a clean validation error. This is pre-existing on `master`, independent of #43337 (the old `inspect.getmembers(pandas_postprocessing, inspect.isfunction)` allowlist has the same gap). Adds `pandas_postprocessing.OPERATIONS`, a curated list of the real DataFrame operations (excludes the two string helpers), and uses it in both the schema allowlist and the executor's dispatch guard. While adding a test for this, found and fixed a second, related bug in the same code path: the `InvalidPostProcessingError` message in `query_object.py` used `type=operation` against a `"...%(operation)s"` format string, so hitting that branch raised a `KeyError` from `flask_babel`'s `gettext` instead of the intended clean error. Fixed to `operation=operation`. ### TESTING INSTRUCTIONS ``` pytest tests/unit_tests/charts/test_schemas.py -k post_processing_operation pytest tests/unit_tests/queries/query_object_test.py -k post_processing ``` Also ran the full `tests/unit_tests/pandas_postprocessing/`, `tests/unit_tests/charts/`, and `tests/unit_tests/queries/` suites locally (349 passed, 2 xfailed, unrelated) and `pre-commit` on the changed files. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
