From 8e7f0237ab375be4adb4aa766d9b9180431fd94d Mon Sep 17 00:00:00 2001
From: Beto Dealmeida <roberto@dealmeida.net>
Date: Fri, 4 Jun 2021 18:12:22 -0700
Subject: [PATCH] fix: apply template_params on external_metadata (#14996)

* fix: apply template_params on external_metadata

* Fix test
---
 superset/connectors/sqla/models.py |  4 +++-
 tests/datasource_tests.py          | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/superset/connectors/sqla/models.py b/superset/connectors/sqla/models.py
index 0842b0e57e..2f7b6d1498 100644
--- a/superset/connectors/sqla/models.py
+++ b/superset/connectors/sqla/models.py
@@ -638,7 +638,9 @@ class SqlaTable(  # pylint: disable=too-many-public-methods,too-many-instance-at
         db_engine_spec = self.db_engine_spec
         if self.sql:
             engine = self.database.get_sqla_engine(schema=self.schema)
-            sql = self.get_template_processor().process_template(self.sql)
+            sql = self.get_template_processor().process_template(
+                self.sql, **self.template_params_dict
+            )
             parsed_query = ParsedQuery(sql)
             if not db_engine_spec.is_readonly_query(parsed_query):
                 raise SupersetSecurityException(
diff --git a/tests/datasource_tests.py b/tests/datasource_tests.py
index 438079fc5b..4ae3957f77 100644
--- a/tests/datasource_tests.py
+++ b/tests/datasource_tests.py
@@ -73,6 +73,25 @@ class TestDatasource(SupersetTestCase):
         session.delete(table)
         session.commit()
 
+    def test_external_metadata_for_virtual_table_template_params(self):
+        self.login(username="admin")
+        session = db.session
+        table = SqlaTable(
+            table_name="dummy_sql_table_with_template_params",
+            database=get_example_database(),
+            sql="select {{ foo }} as intcol",
+            template_params=json.dumps({"foo": "123"}),
+        )
+        session.add(table)
+        session.commit()
+
+        table = self.get_table_by_name("dummy_sql_table_with_template_params")
+        url = f"/datasource/external_metadata/table/{table.id}/"
+        resp = self.get_json_resp(url)
+        assert {o.get("name") for o in resp} == {"intcol"}
+        session.delete(table)
+        session.commit()
+
     def test_external_metadata_for_malicious_virtual_table(self):
         self.login(username="admin")
         table = SqlaTable(