bito-code-review[bot] commented on code in PR #44893:
URL: https://github.com/apache/superset/pull/44893#discussion_r4172284480
##########
superset/mcp_service/dashboard/schemas.py:
##########
@@ -2307,8 +2308,43 @@ def _validate_default_time_range(cls, v: str | None) ->
str | None:
return validate_time_range(v)
+class FilterRangeSpec(BaseNewFilterSpec):
+ """Spec for a new numerical range (filter_range) native filter."""
+
+ filter_type: Literal["filter_range"] = Field(
+ ..., description="Discriminator - must be 'filter_range'"
+ )
+ dataset_id: int = Field(..., description="ID of the dataset to filter on")
+ column: str = Field(
+ ...,
+ min_length=1,
+ description="Name of the numeric dataset column to filter on",
+ )
+ enable_empty_filter: bool = Field(
+ False, description="Require a value before the filter is applied"
+ )
+
+
+class FilterTimeGrainSpec(BaseNewFilterSpec):
+ """Spec for a new time grain (filter_timegrain) native filter."""
+
+ filter_type: Literal["filter_timegrain"] = Field(
+ ..., description="Discriminator - must be 'filter_timegrain'"
+ )
+ dataset_id: int = Field(
+ ...,
+ description=(
+ "ID of the dataset whose supported time grains this filter "
+ "offers and validates selections against"
+ ),
+ )
Review Comment:
<!-- Bito Reply -->
The fix implemented in commit 1ad80c868c69c756736d8ee807080d2ef10d1cb0
correctly addresses the issue where Pydantic v2's lax mode could coerce boolean
values into integer dataset IDs. By adding a validator that rejects boolean
inputs for `dataset_id` in the `FilterRangeSpec` and `FilterTimeGrainSpec`
classes, the code now prevents silent, incorrect dataset targeting. This
mirrors existing security guards used elsewhere in the codebase for similar
identifiers.
**superset/mcp_service/dashboard/schemas.py**
```
class FilterRangeSpec(BaseNewFilterSpec):
# ...
dataset_id: int = Field(..., description="ID of the dataset to filter
on")
# ...
@field_validator("dataset_id", mode="before")
@classmethod
def reject_bool_dataset_id(cls, v: Any) -> Any:
if isinstance(v, bool):
raise ValueError("dataset_id cannot be a boolean")
return v
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
