mirror of
https://github.com/apache/superset.git
synced 2024-09-06 05:47:43 -04:00
chore(sqla): assert query is single read-only statement (#11236)
This commit is contained in:
parent
e647286393
commit
9f3d089655
@ -64,6 +64,7 @@ from superset.jinja_context import (
|
|||||||
from superset.models.annotations import Annotation
|
from superset.models.annotations import Annotation
|
||||||
from superset.models.core import Database
|
from superset.models.core import Database
|
||||||
from superset.models.helpers import AuditMixinNullable, QueryResult
|
from superset.models.helpers import AuditMixinNullable, QueryResult
|
||||||
|
from superset.sql_parse import ParsedQuery
|
||||||
from superset.typing import Metric, QueryObjectDict
|
from superset.typing import Metric, QueryObjectDict
|
||||||
from superset.utils import core as utils, import_datasource
|
from superset.utils import core as utils, import_datasource
|
||||||
|
|
||||||
@ -755,6 +756,14 @@ class SqlaTable( # pylint: disable=too-many-public-methods,too-many-instance-at
|
|||||||
)
|
)
|
||||||
|
|
||||||
from_sql = sqlparse.format(from_sql, strip_comments=True)
|
from_sql = sqlparse.format(from_sql, strip_comments=True)
|
||||||
|
if len(sqlparse.split(from_sql)) > 1:
|
||||||
|
raise QueryObjectValidationError(
|
||||||
|
_("Virtual dataset query cannot consist of multiple statements")
|
||||||
|
)
|
||||||
|
if not ParsedQuery(from_sql).is_readonly():
|
||||||
|
raise QueryObjectValidationError(
|
||||||
|
_("Virtual dataset query must be read-only")
|
||||||
|
)
|
||||||
return TextAsFrom(sa.text(from_sql), []).alias("expr_qry")
|
return TextAsFrom(sa.text(from_sql), []).alias("expr_qry")
|
||||||
return self.get_sqla_table()
|
return self.get_sqla_table()
|
||||||
|
|
||||||
|
@ -187,3 +187,45 @@ class TestDatabaseModel(SupersetTestCase):
|
|||||||
if get_example_database().backend != "presto":
|
if get_example_database().backend != "presto":
|
||||||
with pytest.raises(QueryObjectValidationError):
|
with pytest.raises(QueryObjectValidationError):
|
||||||
table.get_sqla_query(**query_obj)
|
table.get_sqla_query(**query_obj)
|
||||||
|
|
||||||
|
def test_multiple_sql_statements_raises_exception(self):
|
||||||
|
base_query_obj = {
|
||||||
|
"granularity": None,
|
||||||
|
"from_dttm": None,
|
||||||
|
"to_dttm": None,
|
||||||
|
"groupby": ["grp"],
|
||||||
|
"metrics": [],
|
||||||
|
"is_timeseries": False,
|
||||||
|
"filter": [],
|
||||||
|
}
|
||||||
|
|
||||||
|
table = SqlaTable(
|
||||||
|
table_name="test_has_extra_cache_keys_table",
|
||||||
|
sql="SELECT 'foo' as grp, 1 as num; SELECT 'bar' as grp, 2 as num",
|
||||||
|
database=get_example_database(),
|
||||||
|
)
|
||||||
|
|
||||||
|
query_obj = dict(**base_query_obj, extras={})
|
||||||
|
with pytest.raises(QueryObjectValidationError):
|
||||||
|
table.get_sqla_query(**query_obj)
|
||||||
|
|
||||||
|
def test_dml_statement_raises_exception(self):
|
||||||
|
base_query_obj = {
|
||||||
|
"granularity": None,
|
||||||
|
"from_dttm": None,
|
||||||
|
"to_dttm": None,
|
||||||
|
"groupby": ["grp"],
|
||||||
|
"metrics": [],
|
||||||
|
"is_timeseries": False,
|
||||||
|
"filter": [],
|
||||||
|
}
|
||||||
|
|
||||||
|
table = SqlaTable(
|
||||||
|
table_name="test_has_extra_cache_keys_table",
|
||||||
|
sql="DELETE FROM foo",
|
||||||
|
database=get_example_database(),
|
||||||
|
)
|
||||||
|
|
||||||
|
query_obj = dict(**base_query_obj, extras={})
|
||||||
|
with pytest.raises(QueryObjectValidationError):
|
||||||
|
table.get_sqla_query(**query_obj)
|
||||||
|
Loading…
Reference in New Issue
Block a user