Unchecking 'Allow DML' returns incorrect errors and blocks more than DML statements #20565
Closed
3 tasks done
Labels
#bug
Bug report
The button
Allow DML
when unchecked blocks quite a bit more than DML. For example, DDL statements are blocked, as are non-modifying statements likeDESCRIBE
. It also returns some confusing errors, for example running a query with incorrect syntax:or
returns the error:

How to reproduce the bug
Allow DML
in your DB settingExpected results
Environment
chrome
latest & 1.4.1
3.8.12
13.4
Checklist
Make sure to follow these steps before submitting your issue - thank you!
Additional context
Error gets raised here by the check here. Examining the
is_select
method here, we rely on sqlparse'sget_type
method, which is implemented here.We can see a few things:
get_type
method also checks up front whether the SQL syntax is correct, and if not, returns it asUNKNOWN
. This is what is happening with the first query, because the token that follows the subquery is punctuation, not DML. This should probably be separate methods, one to check the type, one to check the syntax in sqlparse.DESCRIBE table X
returns an 'UNKNOWN' type from that method, so that gets blocked from runningAllow DML
blocks far more than just DML statements, it will also block DDL statements for instance.Proposed direction
I'm unsure whether we would want to support syntax validation in Superset, or if that's the responsibility of the DB engine. If we want to push the responsibility down to the engine for snytax, then we can replace the
get_type
method by just checking each token, and whether they contain DML or DDL. For example something like:or if the idea behind the feature was to block any kind of modification, we should replace that button with something like "database.allow_modifications" or something along those lines and block both DDL & DML in the same loop.
If we do want to support syntax validation in Superset, that might be difficult since every DB has different syntax. In any case, it probably shouldn't happen in
get_type
since that results in confusing errors for the end user.The text was updated successfully, but these errors were encountered: