sadpandajoe commented on code in PR #43345:
URL: https://github.com/apache/superset/pull/43345#discussion_r3826301627
##########
superset/charts/schemas.py:
##########
@@ -978,14 +977,7 @@ class ChartDataPostProcessingOperationSchema(Schema):
"example": "aggregate",
},
required=True,
- validate=validate.OneOf(
- choices=[
- name
- for name, value in inspect.getmembers(
- pandas_postprocessing, inspect.isfunction
- )
- ]
- ),
+ validate=validate.OneOf(choices=pandas_postprocessing.OPERATIONS),
Review Comment:
Rebasing this static allowlist as written would drop master’s
`EXTRA_PANDAS_POSTPROCESSING_OPS` extension point, so configured custom
operations would start returning 400 errors. Could this be rebased to restrict
only built-in operations while preserving the extra-operation validation and
dispatch paths?
##########
superset/charts/schemas.py:
##########
@@ -978,14 +977,7 @@ class ChartDataPostProcessingOperationSchema(Schema):
"example": "aggregate",
},
required=True,
- validate=validate.OneOf(
- choices=[
- name
- for name, value in inspect.getmembers(
- pandas_postprocessing, inspect.isfunction
- )
- ]
- ),
+ validate=validate.OneOf(choices=pandas_postprocessing.OPERATIONS),
Review Comment:
The checked-in OpenAPI enum still advertises `escape_separator` and
`unescape_separator`, so generated clients can submit documented values that
this validation now rejects. Could the OpenAPI resource be regenerated with
this allowlist change?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
