Server-side parameter validation

redash/handlers/api.py

@@ -6,7 +6,7 @@
 from redash.handlers.base import org_scoped_rule
 from redash.handlers.permissions import ObjectPermissionsListResource, CheckPermissionResource
 from redash.handlers.alerts import AlertResource, AlertListResource, AlertSubscriptionListResource, AlertSubscriptionResource
-from redash.handlers.dashboards import DashboardListResource, DashboardResource, DashboardShareResource, PublicDashboardResource 
+from redash.handlers.dashboards import DashboardListResource, DashboardResource, DashboardShareResource, PublicDashboardResource
 from redash.handlers.data_sources import DataSourceTypeListResource, DataSourceListResource, DataSourceSchemaResource, DataSourceResource, DataSourcePauseResource, DataSourceTestResource
 from redash.handlers.events import EventsResource
 from redash.handlers.queries import QueryForkResource, QueryRefreshResource, QueryListResource, QueryRecentResource, QuerySearchResource, QueryResource, MyQueriesResource
@@ -92,6 +92,7 @@ def json_representation(data, code, headers=None):
 api.add_org_resource(QueryResultResource,
                      '/api/query_results/<query_result_id>.<filetype>',
                      '/api/query_results/<query_result_id>',
+                     '/api/queries/<query_id>/results',
                      '/api/queries/<query_id>/results.<filetype>',
                      '/api/queries/<query_id>/results/<query_result_id>.<filetype>',
                      endpoint='query_result')

redash/handlers/query_results.py

@@ -10,7 +10,7 @@
                                 require_permission, view_only)
 from redash.tasks import QueryTask
 from redash.tasks.queries import enqueue_query
-from redash.utils import (collect_parameters_from_request, gen_query_hash, json_dumps, utcnow)
+from redash.utils import (collect_parameters_from_request, gen_query_hash, json_dumps, json_loads, utcnow)
 from redash.utils.parameterized_query import ParameterizedQuery
 
 
@@ -64,7 +64,7 @@ def run_query_sync(data_source, parameter_values, query_text, max_age=0):
         return None
 
 
-def run_query(data_source, parameter_values, query_text, query_id, max_age=0):
+def run_query(data_source, parameter_values, query_text, query_id, max_age=0, parameter_schema={}):
     if data_source.paused:
         if data_source.pause_reason:
             message = '{} is paused ({}). Please try later.'.format(data_source.name, data_source.pause_reason)
@@ -73,7 +73,7 @@ def run_query(data_source, parameter_values, query_text, query_id, max_age=0):
 
         return error_response(message)
 
-    query = ParameterizedQuery(query_text).apply(parameter_values)
+    query = ParameterizedQuery(query_text, parameter_schema).apply(parameter_values)
 
     if query.missing_params:
         return error_response(u'Missing parameter value for: {}'.format(u", ".join(query.missing_params)))
@@ -154,6 +154,42 @@ def options(self, query_id=None, query_result_id=None, filetype='json'):
 
         return make_response("", 200, headers)
 
+    def _fetch_rows(self, query_id):
+        query = models.Query.get_by_id_and_org(query_id, self.current_org)
+        query_result = models.QueryResult.get_by_id_and_org(query.latest_query_data_id, self.current_org)
+        return json_loads(query_result.data)["rows"]
+
+    def _convert_queries_to_enums(self, definition):
+        if definition["type"] == "query":
+            definition["type"] = "enum"
+
+            rows = self._fetch_rows(definition.pop("queryId"))
+            definition["enumOptions"] = [row.get('value', row.get(row.keys()[0])) for row in rows]
+
+        return definition
+
+    @require_permission('execute_query')
+    def post(self, query_id):
+        """
+        Execute a saved query.
+
+        :param number query_id: The ID of the query whose results should be fetched.
+        :param object parameters: The parameter values to apply to the query.
+        :qparam number max_age: If query results less than `max_age` seconds old are available,
+                                return them, otherwise execute the query; if omitted or -1, returns
+                                any cached result, or executes if not available. Set to zero to
+                                always execute.
+        """
+        params = request.get_json(force=True)
+        parameters = params.get('parameters', {})
+        max_age = int(params.get('max_age', 0))
+
+        query = get_object_or_404(models.Query.get_by_id_and_org, query_id, self.current_org)
+        parameter_schema = query.options.get("parameters", {})
+        parameter_schema = map(self._convert_queries_to_enums, parameter_schema)
+
+        return run_query(query.data_source, parameters, query.query_text, query_id, max_age, parameter_schema=parameter_schema)
+
     @require_permission('view_query')
     def get(self, query_id=None, query_result_id=None, filetype='json'):
         """

redash/utils/parameterized_query.py

@@ -1,7 +1,7 @@
 import pystache
 from redash.utils import mustache_render
 from funcy import distinct
-
+from dateutil.parser import parse
 
 def _collect_key_names(nodes):
     keys = []
@@ -33,17 +33,59 @@ def _parameter_names(parameter_values):
     return names
 
 
+def _is_date(string):
+    try:
+        parse(string)
+        return True
+    except ValueError:
+        return False
+
+
+def _is_date_range(obj):
+    try:
+        return _is_date(obj["start"]) and _is_date(obj["end"])
+    except (KeyError, TypeError):
+        return False
+
+
 class ParameterizedQuery(object):
-    def __init__(self, template):
+    def __init__(self, template, schema={}):
         self.template = template
+        self.schema = schema
         self.query = template
         self.parameters = {}
 
     def apply(self, parameters):
-        self.parameters.update(parameters)
-        self.query = mustache_render(self.template, self.parameters)
+        invalid_parameter_names = [key for (key, value) in parameters.iteritems() if not self._valid(key, value)]
+        if invalid_parameter_names:
+            message = u"The following parameter values are incompatible with their type definitions: {}".format(",".join(invalid_parameter_names))
+            raise InvalidParameterError(message)
+        else:
+            self.parameters.update(parameters)
+            self.query = mustache_render(self.template, self.parameters)
+
         return self
 
+    def _valid(self, name, value):
+        definition = next((definition for definition in self.schema if definition["name"] == name), None)
+
+        if not definition:
+            return True
+
+        validators = {
+            "text": lambda x: type(x) in (str, unicode),
+            "number": lambda x: type(x) == int,
+            "enum": lambda x: x in definition["enumOptions"],
+            "date": _is_date,
+            "datetime-local": _is_date,
+            "datetime-with-seconds": _is_date,
+            "date-range": _is_date_range,
+            "datetime-range": _is_date_range,
+            "datetime-range-with-seconds": _is_date_range,
+        }
+
+        return validators[definition["type"]](value)
+
     @property
     def missing_params(self):
         query_parameters = set(_collect_query_parameters(self.template))
@@ -52,3 +94,7 @@ def missing_params(self):
     @property
     def text(self):
         return self.query
+
+
+class InvalidParameterError(Exception):
+    pass

tests/handlers/test_query_results.py

@@ -128,6 +128,14 @@ def test_has_full_access_to_data_source(self):
         rv = self.make_request('get', '/api/query_results/{}'.format(query_result.id))
         self.assertEquals(rv.status_code, 200)
 
+    def test_execute_new_query(self):
+        query = self.factory.create_query()
+
+        rv = self.make_request('post', '/api/queries/{}/results'.format(query.id), data={'parameters': {}})
+
+        self.assertEquals(rv.status_code, 200)
+        self.assertIn('job', rv.json)
+
     def test_access_with_query_api_key(self):
         ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=False)
         query = self.factory.create_query()

tests/utils/test_parameterized_query.py

@@ -1,6 +1,7 @@
 from unittest import TestCase
+import pytest
 
-from redash.utils.parameterized_query import ParameterizedQuery
+from redash.utils.parameterized_query import ParameterizedQuery, InvalidParameterError
 
 
 class TestParameterizedQuery(TestCase):
@@ -41,3 +42,85 @@ def test_handles_objects(self):
             }
         })
         self.assertEqual(set([]), query.missing_params)
+
+    def test_raises_on_invalid_text_parameters(self):
+        schema = [{"name": "bar", "type": "text"}]
+        query = ParameterizedQuery("foo", schema)
+
+        with pytest.raises(InvalidParameterError):
+            query.apply({"bar": 7})
+
+    def test_validates_text_parameters(self):
+        schema = [{"name": "bar", "type": "text"}]
+        query = ParameterizedQuery("foo {{bar}}", schema)
+
+        query.apply({"bar": u"baz"})
+
+        self.assertEquals("foo baz", query.text)
+
+    def test_raises_on_invalid_number_parameters(self):
+        schema = [{"name": "bar", "type": "number"}]
+        query = ParameterizedQuery("foo", schema)
+
+        with pytest.raises(InvalidParameterError):
+            query.apply({"bar": "baz"})
+
+    def test_validates_number_parameters(self):
+        schema = [{"name": "bar", "type": "number"}]
+        query = ParameterizedQuery("foo {{bar}}", schema)
+
+        query.apply({"bar": 7})
+
+        self.assertEquals("foo 7", query.text)
+
+    def test_raises_on_invalid_date_parameters(self):
+        schema = [{"name": "bar", "type": "date"}]
+        query = ParameterizedQuery("foo", schema)
+
+        with pytest.raises(InvalidParameterError):
+            query.apply({"bar": "baz"})
+
+    def test_validates_date_parameters(self):
+        schema = [{"name": "bar", "type": "date"}]
+        query = ParameterizedQuery("foo {{bar}}", schema)
+
+        query.apply({"bar": "2000-01-01 12:00:00"})
+
+        self.assertEquals("foo 2000-01-01 12:00:00", query.text)
+
+    def test_raises_on_invalid_enum_parameters(self):
+        schema = [{"name": "bar", "type": "enum", "enumOptions": ["baz", "qux"]}]
+        query = ParameterizedQuery("foo", schema)
+
+        with pytest.raises(InvalidParameterError):
+            query.apply({"bar": 7})
+
+    def test_raises_on_unlisted_enum_value_parameters(self):
+        schema = [{"name": "bar", "type": "enum", "enumOptions": ["baz", "qux"]}]
+        query = ParameterizedQuery("foo", schema)
+
+        with pytest.raises(InvalidParameterError):
+            query.apply({"bar": "shlomo"})
+
+    def test_validates_enum_parameters(self):
+        schema = [{"name": "bar", "type": "enum", "enumOptions": ["baz", "qux"]}]
+        query = ParameterizedQuery("foo {{bar}}", schema)
+
+        query.apply({"bar": "baz"})
+
+        self.assertEquals("foo baz", query.text)
+
+    def test_raises_on_invalid_date_range_parameters(self):
+        schema = [{"name": "bar", "type": "date-range"}]
+        query = ParameterizedQuery("foo", schema)
+
+        with pytest.raises(InvalidParameterError):
+            query.apply({"bar": "baz"})
+
+    def test_validates_date_range_parameters(self):
+        schema = [{"name": "bar", "type": "date-range"}]
+        query = ParameterizedQuery("foo {{bar.start}} {{bar.end}}", schema)
+
+        query.apply({"bar": {"start": "2000-01-01 12:00:00", "end": "2000-12-31 12:00:00"}})
+
+        self.assertEquals("foo 2000-01-01 12:00:00 2000-12-31 12:00:00", query.text)