fix(sql): use AST for disallowed function checks by wangfenjin · Pull Request #43641 · apache/superset

wangfenjin · 2026-08-28T06:57:00Z

SUMMARY

The unified SQL executor currently stringifies parsed SQL and checks each configured disallowed function with substring containment. For PostgreSQL, the default version denylist therefore rejects identifiers such as conversion and custom_skill_versions, as well as literals and comments containing that text.

Reuse the existing SQLScript.check_functions_present AST matcher so the denylist applies to actual function calls. This keeps version() and pg_catalog.version() blocked without weakening the configured check, while avoiding false positives in identifiers, literals, and comments.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Not applicable; this is a backend SQL validation change.

TESTING INSTRUCTIONS

Run pytest tests/unit_tests/sql/execution/test_executor.py -k disallowed_functions.
Verify version() and pg_catalog.version() are reported as disallowed.
Verify conversion, quoted identifiers, custom_skill_versions, string literals, and comments do not produce false positives.
Run pre-commit run against the staged files.

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

bito-code-review · 2026-08-28T06:57:11Z

Code Review Agent Run #0e3cf4

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: 288e551..288e551
- superset/sql/execution/executor.py
- tests/unit_tests/sql/execution/test_executor.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-08-28T07:03:35Z

The flagged issue is correct. The current implementation in the diff uses a set comprehension that calls script.check_functions_present({func}) for every function in engine_disallowed, which triggers redundant AST traversals.

To resolve this, you should compute the set of all functions present in the script once and then find the intersection with the denylist. Assuming script provides a way to get all present functions (e.g., script.get_all_functions()), the implementation would look like this:

        # Compute present functions once
        present_functions = script.get_all_functions()
        found = {func for func in engine_disallowed if func in present_functions}

If script.get_all_functions() is not available, you should expose a method that performs a single AST traversal to collect all function names, then perform the intersection.

There are no other comments on this PR to address.

superset/sql/execution/executor.py

# Compute present functions once
        present_functions = script.get_all_functions()
        found = {func for func in engine_disallowed if func in present_functions}

codecov · 2026-08-28T07:15:03Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.19%. Comparing base (12cd259) to head (4c2b2ea).

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #43641   +/-   ##
=======================================
  Coverage   79.19%   79.19%           
=======================================
  Files        2879     2879           
  Lines      165870   165872    +2     
  Branches    38352    38350    -2     
=======================================
+ Hits       131354   131356    +2     
  Misses      32039    32039           
  Partials     2477     2477

Flag	Coverage Δ
hive	`37.94% <33.33%> (+<0.01%)`	⬆️
mysql	`57.67% <50.00%> (+<0.01%)`	⬆️
postgres	`57.70% <50.00%> (-0.01%)`	⬇️
presto	`39.85% <33.33%> (+<0.01%)`	⬆️
python	`83.74% <100.00%> (+<0.01%)`	⬆️
sqlite	`57.39% <50.00%> (+<0.01%)`	⬆️
unit	`73.96% <100.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

wangfenjin · 2026-08-28T08:07:03Z

@bito-code-review review

bito-code-review · 2026-08-28T10:18:28Z

Code Review Agent Run #65ceff

Actionable Suggestions - 0

Review Details

Files reviewed - 3 · Commit Range: 288e551..4c2b2ea
- superset/sql/execution/executor.py
- superset/sql/parse.py
- tests/unit_tests/sql/execution/test_executor.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

fix(sql): match disallowed functions by AST

288e551

pull-request-size Bot added the size/M label Aug 28, 2026

dosubot Bot added change:backend Requires changing the backend sqllab Namespace | Anything related to the SQL Lab labels Aug 28, 2026

codeant-ai-for-open-source Bot reviewed Aug 28, 2026

View reviewed changes

Comment thread superset/sql/execution/executor.py Outdated

perf(sql): avoid repeated function AST walks

4c2b2ea

pull-request-size Bot added size/L and removed size/M labels Aug 28, 2026

rusackas requested review from betodealmeida, msyavuz and rusackas August 29, 2026 03:31

Navigation Menu

Uh oh!

fix(sql): use AST for disallowed function checks - #43641

fix(sql): use AST for disallowed function checks#43641
wangfenjin wants to merge 2 commits into
apache:masterfrom
wangfenjin:fix/sql-executor-function-denylist-ast

wangfenjin commented Aug 28, 2026 •

edited

Loading

Uh oh!

bito-code-review Bot commented Aug 28, 2026 •

edited

Loading

Code Review Agent Run #0e3cf4

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 28, 2026

Uh oh!

codecov Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

wangfenjin commented Aug 28, 2026

Uh oh!

bito-code-review Bot commented Aug 28, 2026 •

edited

Loading

Code Review Agent Run #65ceff

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

wangfenjin commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

bito-code-review Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #0e3cf4

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 28, 2026

Uh oh!

codecov Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

wangfenjin commented Aug 28, 2026

Uh oh!

bito-code-review Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #65ceff

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

wangfenjin commented Aug 28, 2026 •

edited

Loading

bito-code-review Bot commented Aug 28, 2026 •

edited

Loading

codecov Bot commented Aug 28, 2026 •

edited

Loading

bito-code-review Bot commented Aug 28, 2026 •

edited

Loading