haveitjoewei opened a new issue, #44434:
URL: https://github.com/apache/superset/issues/44434
## Summary
SQL injection vulnerability in Presto partition query filter values in
`superset/db_engine_specs/presto.py`. Filter values are interpolated directly
into SQL strings without proper escaping.
## Severity
**Medium** - Potential SQL injection if filter values can be manipulated by
users.
## Affected Files
- `superset/db_engine_specs/presto.py:532-536`
## Current Behavior
```python
where_clause = ""
if filters:
l = [] # noqa: E741
for field, value in filters.items():
l.append(f"{field} = '{value}'")
where_clause = "WHERE " + " AND ".join(l)
```
Filter values are interpolated without proper escaping or parameterization.
## Expected Behavior
Filter values should be properly escaped or parameterized to prevent SQL
injection.
## Security Impact
While table and schema names come from trusted metadata, filter values could
potentially be manipulated. An attacker who can control the `filters` dict
could inject malicious SQL into the partition query.
This is particularly concerning given Superset's history of SQL injection
vulnerabilities (CVE-2024-39887, CVE-2025-48912) and the ongoing security focus
on proper SQL construction.
## Proposed Fix
Use SQLAlchemy's parameter binding or proper identifier quoting for filter
values, similar to how other parts of the codebase handle user-supplied SQL
values.
## Additional Context
- Line 544 also uses f-string interpolation for table names, but those come
from metadata
- Similar SQL injection patterns have been reported in Superset's security
history
- The partition query functionality is used for metadata discovery in
Presto/Trino databases
Generated with [Devin](https://devin.ai)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
