aminghadersohi commented on PR #45242: URL: https://github.com/apache/superset/pull/45242#issuecomment-6151186162
Full-diff review of https://github.com/apache/superset/pull/45242 against `master` at `20ba9678d14d0459c60193087915dff178f50304`. Fixed in `c6c87e3c026cea30687a75446cd18b42b059daec`: - **MEDIUM — dashboard-scope correctness:** this scope-neutral permalink tool could return unfiltered column suggestions while active dashboard filters restricted rows. It now preserves requested values unchecked without reading column options in that mode. This is a filtered-view correctness issue, not an RBAC bypass. - **MEDIUM — locale-sensitive lookup:** containment searches could falsely reject valid ASCII `I` values beyond the first page when SQL lowercasing differs from Python. Search terms now exclude locale-sensitive `I/i`, with regressions simulating Turkish-style lowercasing. SQL case conversion depends on collation; see the [PostgreSQL documentation](https://www.postgresql.org/docs/15/collation.html). - **MEDIUM — query amplification:** distinct requested values could trigger an uncapped number of containment queries. Searches now have a ten-attempt budget per filter, counting and caching failures; further values remain unchecked. - **LOW — zero-limit hardening, fixed:** nonpositive effective row limits now skip validation rather than reaching the unlimited column-query path. The regressions failed before their fixes. Final validation: **544 tests passed** across apply-dashboard-filters, dashboard-scope, and tool-inventory suites; all applicable pre-commit hooks passed on all five PR files, including mypy, Ruff, and pylint. Also checked scalar types, NULLs, case/Unicode/whitespace, exact-match precedence, truncation and ambiguity guidance, bounded suggestions, dataset permission denial, and real-query regular/guest RLS coverage. No additional findings. Live warehouse collations and physical scan costs were not tested: result limits and query-count budgets do not guarantee bounded backend rows scanned. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
