bito-code-review[bot] commented on code in PR #43560:
URL: https://github.com/apache/superset/pull/43560#discussion_r3865539612
##########
superset/utils/excel.py:
##########
@@ -21,21 +21,33 @@
from superset.utils.core import GenericDataType
+# Leading characters that turn a cell into a formula in spreadsheet apps.
+FORMULA_PREFIXES = {"=", "+", "-", "@"}
+
+
+def _quote_formula(value: Any) -> Any:
+ """Prefix a string with a quote when it would parse as a formula."""
+ return (
+ f"'{value}"
+ if isinstance(value, str) and len(value) and value[0] in
FORMULA_PREFIXES
+ else value
+ )
+
def quote_formulas(df: pd.DataFrame) -> pd.DataFrame:
"""
Make sure to quote any formulas for security reasons.
"""
- formula_prefixes = {"=", "+", "-", "@"}
-
- for col in df.select_dtypes(include="object").columns:
- df[col] = df[col].apply(
- lambda x: (
- f"'{x}"
- if isinstance(x, str) and len(x) and x[0] in formula_prefixes
- else x
- )
- )
+ # Columns are addressed by position rather than by label: a dataframe can
+ # carry duplicate column labels (the verbose_map rename in
+ # QueryContextProcessor.get_data can collapse two columns onto the same
+ # name), and ``df[label]`` then yields a DataFrame instead of a Series.
+ # ``DataFrame.apply`` would hand whole columns to the mapper rather than
+ # individual cells, silently leaving formulas unquoted.
+ for idx in range(len(df.columns)):
+ series = df.iloc[:, idx]
+ if series.dtype == object:
+ df.isetitem(idx, series.map(_quote_formula))
Review Comment:
<!-- Bito Reply -->
The clarification regarding the pandas 3.x string semantics is noted. The
updated implementation using both `is_object_dtype` and `is_string_dtype` is
correct for ensuring formula quoting is applied to dedicated string columns,
and the addition of a deterministic test case is appropriate for verifying this
behavior.
**superset/utils/excel.py**
```
for idx in range(len(df.columns)):
series = df.iloc[:, idx]
if pd.api.types.is_object_dtype(series.dtype) or
pd.api.types.is_string_dtype(series.dtype):
df.isetitem(idx, series.map(_quote_formula))
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
