aminghadersohi commented on code in PR #44496:
URL: https://github.com/apache/superset/pull/44496#discussion_r4064938326
##########
superset/sql/parse.py:
##########
@@ -1371,6 +1395,15 @@ def is_mutating(self) -> bool:
return False
+ def get_client_file_transfer_command(self) -> str | None:
+ """
+ Return the client-side file-transfer command head, if this is one.
+
+ :return: The uppercased command head (e.g. ``"PUT"``), else ``None``.
+ """
+ head = self._command_head()
Review Comment:
On the pinned sqlglot 30.18.0, `PUT 'file:///x' @s` and `GET @s 'file:///x'`
parse to `exp.Put`/`exp.Get`, not `exp.Command`. `_command_head()` returns
None, so both gates pass them, and `has_mutation()` is False too. Quoting the
path is documented Snowflake syntax.
```suggestion
# A quoted local path parses into a structured node instead of the
# opaque Command fallback (``PUT 'file://...' @s`` -> ``exp.Put``).
# Both nodes are Snowflake-only, so no other dialect is affected.
if isinstance(self._parsed, (exp.Put, exp.Get)):
return type(self._parsed).__name__.upper()
head = self._command_head()
```
##########
superset/sql/execution/executor.py:
##########
@@ -604,6 +604,19 @@ def _check_security(self, script: SQLScript, schema: str |
None = None) -> None:
)
)
+ # Rejected regardless of `allow_dml`: these do host file I/O, not DML.
+ if file_transfer_commands :=
script.get_client_file_transfer_commands():
+ raise SupersetSecurityException(
+ SupersetError(
+ message=(
+ "SQL statement contains disallowed client-side "
+ f"file-transfer command(s): {file_transfer_commands}"
Review Comment:
Raw set interpolation renders the heads in a nondeterministic order
(`{'GET', 'PUT', 'REMOVE'}` — 4 orderings in 6 runs here) and diverges from the
two sibling gates just above, which both use `', '.join(...)`.
```suggestion
f"file-transfer command(s): "
f"{', '.join(sorted(file_transfer_commands))}"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
