fix: add SQL length limit to prevent resource exhaustion by sha174n · Pull Request #13 · sha174n/superset

sha174n · 2026-04-01T22:16:18Z

Summary

This PR addresses a SQL parser resource exhaustion vulnerability (CWE-400) in SQL Lab.

Previously, there was no limit on the length of the SQL query passed to the sqlglot parser in the execute, format, and cost estimation endpoints. A very large or specially crafted SQL query could cause the parser to consume excessive CPU or memory, leading to a Denial of Service (DoS).

Changes:

Added a new configuration SQLLAB_MAX_SQL_LENGTH (defaulting to 1MB).
Implemented a validator validate_sql_length in superset/sqllab/schemas.py.
Applied this validator to the sql field in ExecutePayloadSchema, FormatQueryPayloadSchema, and EstimateQueryCostSchema.
Added an integration test to verify the protection.

…apache#38890) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…erating URL (apache#38951)

…#38886)

…SL drops (apache#38934) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…pache#38955) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… tool calls (apache#38747)

…zed responses (apache#38959)

…mns (apache#38809) Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>

…matting (apache#38953) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…ange record (apache#38883) Signed-off-by: hainenber <dotronghai96@gmail.com>

apache#38968) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…socket/utils/client-ws-app (apache#38935) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…pache#38944) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…harts (apache#38673)

…8403) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…hart (apache#38978)

…k.gl errors (apache#38977)

…ocket (apache#38861) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…dded-sdk (apache#38864) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…end (apache#38875) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ache#38888)

Co-authored-by: Claude Code <noreply@anthropic.com> Co-authored-by: Rui Zhao <zhaorui@dropbox.com> Co-authored-by: Joe Li <joe@preset.io>

Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: hainenber <dotronghai96@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: hainenber <dotronghai96@gmail.com>

…frontend/cypress-base (apache#38919) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…superset-embedded-sdk (apache#38920) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…che#38981) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ines for `npm run check:custom-rules` (apache#38938) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: hainenber <dotronghai96@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: hainenber <dotronghai96@gmail.com>

… 8.57.0 in /superset-websocket (apache#38540) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…-frontend (apache#38505) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Evan Rusackas <evan@preset.io> Co-authored-by: Joe Li <joe@preset.io>

…nd (apache#38999) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…docs (apache#38998) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…websocket (apache#38995) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…are Jinja rendering (apache#38984) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

….5 to ~9.2.9 in /superset-frontend/plugins/legacy-preset-chart-deckgl (apache#38148) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joe Li <joe@preset.io>

…pache#38438) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joe Li <joe@preset.io>

…ontend (apache#38507) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…iew filters (apache#38987)

apache#38993) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…apache#39001) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…dashboard titles (apache#38990)

…ntal scroll (apache#39009) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>

… x-axis labels (apache#39012)

…8928)

…in /superset-frontend/packages/generator-superset (apache#38383) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joe Li <joe@preset.io>

….2.9 in /superset-frontend/plugins/legacy-preset-chart-deckgl (apache#38149) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joe Li <joe@preset.io>

…uperset-frontend (apache#38333) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joe Li <joe@preset.io>

…frontend (apache#38510) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Evan Rusackas <evan@preset.io> Co-authored-by: Joe Li <joe@preset.io>

…in /superset-frontend/plugins/legacy-preset-chart-deckgl (apache#38150) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

aminghadersohi and others added 30 commits March 30, 2026 11:26

fix(mcp): prevent GRID_ID injection into ROOT_ID on tabbed dashboards (…

aa1a695

…apache#38890) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

fix(mcp): validate dataset exists in generate_explore_link before gen…

89f7e5e

…erating URL (apache#38951)

fix(select): ensure filter dropdown matches input field width (apache…

41d401a

…#38886)

fix(mcp): prevent PendingRollbackError from poisoned sessions after S…

d331a04

…SL drops (apache#38934) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

feat(mcp): support saved metrics from datasets in chart generation (a…

15bab22

…pache#38955) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(mcp): prevent stale g.user from causing user impersonation across…

38fdfb4

… tool calls (apache#38747)

fix(mcp): enforce MAX_PAGE_SIZE limit on list tools to prevent oversi…

2c9cf0b

…zed responses (apache#38959)

fix(charts): add X Axis Number Format control for numeric X-axis colu…

e0a0a22

…mns (apache#38809) Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>

fix(pivot-table): safely cast numeric strings to numbers for date for…

f1cd1ae

…matting (apache#38953) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(AlteredSliceTag): not display undefined filter value for chart ch…

11f2140

…ange record (apache#38883) Signed-off-by: hainenber <dotronghai96@gmail.com>

chore(deps-dev): bump typescript-eslint from 8.57.2 to 8.58.0 in /docs (

b49e899

apache#38968) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

docs: Fix misleading links in UPDATING.md (apache#38947)

b1474aa

chore(deps): bump path-to-regexp from 8.2.0 to 8.4.0 in /superset-web…

ecbf396

…socket/utils/client-ws-app (apache#38935) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump antd from 6.3.4 to 6.3.5 in /docs (apache#38967)

944944c

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump aws-actions/amazon-ecr-login from 2.0.2 to 2.1.1 (a…

e6f1209

…pache#38944) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix(echarts): adapt y-axis ticks and padding for compact timeseries c…

f0b20dc

…harts (apache#38673)

feat(mcp): add Big Number chart type support to MCP service (apache#3…

4245720

…8403) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

fix(mcp): add TEMPORAL_RANGE filter for temporal x-axis in generate_c…

c37a3ec

…hart (apache#38978)

fix(mcp): batch fix for execute_sql crashes, null timestamps, and dec…

daefede

…k.gl errors (apache#38977)

fix(bubble): Fix Bubble chart axis label rotation (apache#38917)

f6cd806

chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 in /superset-webs…

7d26e33

…ocket (apache#38861) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 in /superset-embe…

a741ddc

…dded-sdk (apache#38864) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps-dev): bump open-cli from 8.0.0 to 9.0.0 in /superset-front…

3abcfb7

…end (apache#38875) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

docs(developer): add celery to testing section for alerts&reports (ap…

55aa36f

…ache#38888)

fix(presto): Fix presto timestamp (apache#26467)

53b1d10

Co-authored-by: Claude Code <noreply@anthropic.com> Co-authored-by: Rui Zhao <zhaorui@dropbox.com> Co-authored-by: Joe Li <joe@preset.io>

chore(deps): bump brace-expansion from 1.1.11 to 1.1.13 in /superset-…

08a4ad6

…frontend/cypress-base (apache#38919) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump serialize-javascript and terser-webpack-plugin in /…

4036b78

…superset-embedded-sdk (apache#38920) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(mcp): clarify saved metrics vs columns in MCP instructions (apa…

6ea9f2a

…che#38981) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dependabot Bot and others added 23 commits March 31, 2026 21:58

chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.56.1 to…

6b6e380

… 8.57.0 in /superset-websocket (apache#38540) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

docs(db): Update crate.py with new Homepage URL (apache#39002)

4ee391e

chore(deps-dev): bump jsdom from 28.1.0 to 29.0.1 in /superset-fronte…

8ed7578

…nd (apache#38999) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump caniuse-lite from 1.0.30001782 to 1.0.30001784 in /…

d30c5b4

…docs (apache#38998) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps-dev): bump @types/node from 25.3.5 to 25.5.0 in /superset-…

64c8d65

…websocket (apache#38995) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix(query): pass datasource table to template processor for schema-aw…

94d8735

…are Jinja rendering (apache#38984) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

chore(deps): bump d3-cloud from 1.2.8 to 1.2.9 in /superset-frontend (a…

6adc816

…pache#38438) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joe Li <joe@preset.io>

chore(deps): bump markdown-to-jsx from 9.7.6 to 9.7.8 in /superset-fr…

5f99d61

…ontend (apache#38507) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix(mcp): fix dashboard owners Pydantic crash and preserve chart prev…

190f1a5

…iew filters (apache#38987)

chore(deps): bump ioredis from 5.10.0 to 5.10.1 in /superset-websocket (

4423134

apache#38993) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump anthropics/claude-code-action from 1.0.82 to 1.0.83 (…

1bb41a6

…apache#39001) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix(mcp): handle table chart raw mode in query builders and sanitize …

0bae05d

…dashboard titles (apache#38990)

fix(dataset-editor): improve modal layout and fix Settings tab horizo…

38f0dc7

…ntal scroll (apache#39009) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>

fix(echarts): fix stacked horizontal bar chart clipping and duplicate…

0223428

… x-axis labels (apache#39012)

fix(ace-editor): fix cursor misalignment in markdown editor (apache#3…

ff3b8d8

…8928)

chore(deps-dev): bump @swc/plugin-emotion from 14.6.0 to 14.7.0 in /s…

00eb86d

…uperset-frontend (apache#38333) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joe Li <joe@preset.io>

chore(deps): update @deck.gl/react requirement from ~9.2.5 to ~9.2.9 …

1aac6c9

…in /superset-frontend/plugins/legacy-preset-chart-deckgl (apache#38150) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix: add SQL length limit to prevent resource exhaustion

67f7418

github-actions Bot added dependencies:npm plugins api doc packages github_actions embedded labels Apr 1, 2026

Navigation Menu

fix: add SQL length limit to prevent resource exhaustion - #13

fix: add SQL length limit to prevent resource exhaustion#13
sha174n wants to merge 64 commits into
masterfrom
fix/sqllab-sql-limit

sha174n commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

Conversation

sha174n commented Apr 1, 2026

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants