wangfenjin opened a new pull request, #43641: URL: https://github.com/apache/superset/pull/43641
### SUMMARY The unified SQL executor currently stringifies parsed SQL and checks each configured disallowed function with substring containment. For PostgreSQL, the default `version` denylist therefore rejects identifiers such as `conversion` and `custom_skill_versions`, as well as literals and comments containing that text. Reuse the existing `SQLScript.check_functions_present` AST matcher so the denylist applies to actual function calls. This keeps `version()` and `pg_catalog.version()` blocked without weakening the configured check, while avoiding false positives in identifiers, literals, and comments. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Not applicable; this is a backend SQL validation change. ### TESTING INSTRUCTIONS 1. Run `pytest tests/unit_tests/sql/execution/test_executor.py -k disallowed_functions`. 2. Verify `version()` and `pg_catalog.version()` are reported as disallowed. 3. Verify `conversion`, quoted identifiers, `custom_skill_versions`, string literals, and comments do not produce false positives. 4. Run `pre-commit run` against the staged files. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
