bito-code-review[bot] commented on PR #43394:
URL: https://github.com/apache/superset/pull/43394#issuecomment-5372413284
<!-- Bito Reply -->
The flagged issue is valid. The `SQLSafeDict` implementation in
`superset/jinja_context.py` currently emits keys directly without escaping,
which could allow an attacker to inject SQL delimiters if a key contains
malicious characters. To resolve this, you should escape the keys in the
`__str__` method of `SQLSafeDict` using the same dialect-aware escaping
mechanism used for values.
Here is a concise fix for `superset/jinja_context.py`:
```python
def __str__(self) -> str:
# Assuming self.dialect is accessible or available in context
return ", ".join(f"{self._escape_key(key)}: {value}" for key, value
in self.items())
```
(Note: You will need to ensure `_escape_key` is defined to handle the
dialect-specific escaping for keys.)
Would you like me to fetch all other comments on this PR to validate and
implement fixes for them as well?
**superset/jinja_context.py**
```
def __str__(self) -> str:
return ", ".join(f"{self._escape_key(key)}: {value}" for key, value
in self.items())
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
