fix(postgres): detect search_path changes via set_config, not only SET by sha174n · Pull Request #43060 · apache/superset

sha174n · 2026-08-11T11:13:57Z

PostgresEngineSpec.get_default_schema_for_query rejects a query that rebinds the session search_path, because a changed search_path alters how unqualified table references resolve. It previously matched only the structured SET search_path = ... form (via get_settings), and missed the equivalent set_config('search_path', ...) function-call form (and other variants).

This switches the guard to changes_search_path(), which already recognises the SET, set_config, and exotic forms in one place. Adds a regression test for the set_config form.

`PostgresEngineSpec.get_default_schema_for_query` rejects a query that rebinds the session `search_path`, because a changed search_path alters how unqualified table references resolve. It previously matched only the structured `SET search_path = ...` form (via `get_settings`), and missed the equivalent `set_config('search_path', ...)` function-call form (and other variants). Switch the guard to `changes_search_path()`, which already recognises the `SET`, `set_config`, and exotic forms in one place. Adds a regression test for the `set_config` form. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bito-code-review · 2026-08-11T11:14:08Z

Code Review Agent Run #240a97

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: 91c5c99..91c5c99
- superset/db_engine_specs/postgres.py
- tests/unit_tests/db_engine_specs/test_postgres.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-08-11T11:19:02Z

The flagged security issue is valid. The current implementation in superset/db_engine_specs/postgres.py relies on changes_search_path(), which correctly identifies various ways to change the search path, including set_config function calls. The provided PR diff already implements this fix by replacing the limited get_settings() check with a more robust check using any(statement.changes_search_path() for statement in script.statements). This ensures that even if set_config uses expressions or dynamic arguments, the security gate will correctly identify and block the attempt to modify the search path.

superset/db_engine_specs/postgres.py

# A query can rebind the session ``search_path`` not only via a
        # structured ``SET search_path = ...`` (surfaced by ``get_settings``)
        # but also via the ``set_config('search_path', ...)`` function and other
        # forms. ``changes_search_path`` recognises all of them; matching on
        # ``get_settings`` alone missed the function-call form, which changes how
        # unqualified table references resolve at runtime.
        if any(statement.changes_search_path() for statement in script.statements):

codecov · 2026-08-11T11:19:32Z

Codecov Report

❌ Patch coverage is 31.25000% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.54%. Comparing base (5ee2793) to head (6498b9a).
⚠️ Report is 11 commits behind head on master.

Files with missing lines	Patch %	Lines
superset/sql/parse.py	33.33%	8 Missing and 2 partials ⚠️
superset/db_engine_specs/postgres.py	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #43060      +/-   ##
==========================================
- Coverage   66.55%   66.54%   -0.01%     
==========================================
  Files        2864     2864              
  Lines      161894   161902       +8     
  Branches    37305    37308       +3     
==========================================
- Hits       107742   107739       -3     
- Misses      52106    52116      +10     
- Partials     2046     2047       +1

Flag	Coverage Δ
hive	`38.15% <6.25%> (-0.01%)`	⬇️
mysql	`57.67% <12.50%> (-0.01%)`	⬇️
postgres	`57.72% <25.00%> (-0.02%)`	⬇️
presto	`40.11% <6.25%> (-0.01%)`	⬇️
python	`59.11% <31.25%> (-0.01%)`	⬇️
sqlite	`57.34% <6.25%> (-0.01%)`	⬇️
unit	`100.00% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Resolve the setting name conservatively: a set_config() name built from an expression, and a set_config() call inside a statement the parser leaves opaque, both count as a rebind. Add a script-level changes_search_path() so the engine spec keeps using the SQLScript surface instead of iterating statements itself. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bito-code-review · 2026-08-11T16:27:03Z

Code Review Agent Run #08d369

Actionable Suggestions - 0

Review Details

Files reviewed - 3 · Commit Range: 91c5c99..6498b9a
- superset/db_engine_specs/postgres.py
- superset/sql/parse.py
- tests/unit_tests/sql/parse_tests.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

pull-request-size Bot added the size/M label Aug 11, 2026

dosubot Bot added the data:connect:postgres Related to Postgres label Aug 11, 2026

codeant-ai-for-open-source Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread superset/db_engine_specs/postgres.py Outdated

pull-request-size Bot added size/L and removed size/M labels Aug 11, 2026

sadpandajoe requested review from Antonio-RiveroMartnez and dpgaspar August 11, 2026 17:22

Navigation Menu

Uh oh!

fix(postgres): detect search_path changes via set_config, not only SET - #43060

fix(postgres): detect search_path changes via set_config, not only SET#43060
sha174n wants to merge 2 commits into
apache:masterfrom
sha174n:fix/postgres-search-path-set-config

sha174n commented Aug 11, 2026

Uh oh!

bito-code-review Bot commented Aug 11, 2026 •

edited

Loading

Code Review Agent Run #240a97

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 11, 2026

Uh oh!

codecov Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

bito-code-review Bot commented Aug 11, 2026 •

edited

Loading

Code Review Agent Run #08d369

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

sha174n commented Aug 11, 2026

Uh oh!

bito-code-review Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #240a97

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 11, 2026

Uh oh!

codecov Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bito-code-review Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #08d369

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

bito-code-review Bot commented Aug 11, 2026 •

edited

Loading

codecov Bot commented Aug 11, 2026 •

edited

Loading

bito-code-review Bot commented Aug 11, 2026 •

edited

Loading