kokhlo commented on issue #44434:
URL: https://github.com/apache/superset/issues/44434#issuecomment-5736986857
Verified against current branches — the escaping this issue asks for is
already on master, so the report is against an older revision (looks like 6.1).
On **master and 7.0**, the block quoted in the issue doesn't exist anymore.
`superset/db_engine_specs/presto.py` (PrestoBaseEngineSpec.select_partitions)
now does:
```python
where_clause = ""
if filters:
l = [] # noqa: E741
for field, value in filters.items():
# Escape single quotes so a ``'`` in the caller-supplied value
# cannot break out of the SQL string literal. See #41869.
escaped_value: str = str(value).replace("'", "''")
l.append(f"{field} = '{escaped_value}'")
where_clause = "WHERE " + " AND ".join(l)
```
That landed in #41877 ("fix(presto): fix latest_sub_partition guard bypass +
escape partition filter values", commit `f8cfa459e`, July) which also added the
`# noqa: S608` marker on the SELECT construction right below.
The unescaped `f"{field} = '{value}'"` form the issue quotes is still
present on the **6.1** branch — so the finding is real there, but the fix
already exists upstream and it's a cherry-pick candidate rather than new work.
Per the project's practice, release-branch backports are cherry-picked by
maintainers from master, so leaving that judgement to them — happy to provide
exact cherry-pick details (the touchpoints are just the filter-escaping hunk in
`select_partitions`) if wanted.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
