rebenitez1802 opened a new pull request, #44308:
URL: https://github.com/apache/superset/pull/44308
### SUMMARY
The AG Grid table's toolbar **Export to CSV / Export to Excel** re-queries
`/api/v1/chart/data` with the active header filters. Those filters were
serialized into a raw `extras.where` / `having` SQL string with the **column
identifier interpolated unquoted**. A column name containing spaces or a
reserved word — e.g. a column named `Destination Address Street` — produced an
unparseable fragment like:
```
Destination Address Street ILIKE '%Main%'
```
which fails the backend's pre-execution `sanitize_clause` parse and returns
a 400 `{"message":"Invalid SQL clause: ..."}` with no file. This affects
**every** SQL dialect (not only ClickHouse) whenever a filtered column name
needs quoting, and there is no single identifier quote character valid across
ClickHouse, Postgres, MySQL and BigQuery (double quotes are string literals in
MySQL/BigQuery; backticks are invalid in Postgres). Unfiltered export and the
live in-grid filtering both work, because only this path builds a raw
identifier string.
The download path now runs the plugin's existing
`convertAgGridFiltersToSQL`, so simple single-condition filters are sent as
structured `{ col, op, val }` filters on `queryObject.filters`. The backend
then quotes each identifier for the target dialect via SQLAlchemy — exactly how
the live in-grid filtering already worked, and it also removes the
string-concatenation injection surface. Compound (AND/OR) and metric (HAVING)
filters keep their existing free-form SQL handling, and the totals/summary
query still excludes the interactive filters.
### BEFORE/AFTER
**Before:** Apply a header filter ("contains" or "is one of") to a column
whose name has spaces or is a reserved word, then Export to CSV/Excel → 400
"Invalid SQL clause", no file produced.
**After:** The export succeeds and returns the filtered rows, matching the
grid view, across dialects.
### TESTING INSTRUCTIONS
1. On a dataset with a column whose name contains a space (e.g. `Destination
Address Street`), build an AG Grid Table (Table V2) chart and place it on a
dashboard.
2. Apply a header "contains" filter on that column and an "is one of" filter
on another spaced column.
3. Export to CSV and to Excel → a file is produced containing only the
filtered rows.
4. Unit tests: `cd superset-frontend && npm run test --
plugins/plugin-chart-ag-grid-table` (adds a regression test asserting
spaced-column contains + set filters become structured `queryObject.filters`
with no raw `extras.where`).
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
