def test_external_metadata_for_malicious_virtual_table(self):
self.login(username="******")
table = SqlaTable(
table_name="malicious_sql_table",
database=get_example_database(),
schema=get_example_default_schema(),
sql="delete table birth_names",
)
with db_insert_temp_object(table):
url = f"/datasource/external_metadata/table/{table.id}/"
resp = self.get_json_resp(url)
self.assertEqual(resp["error"], "Only `SELECT` statements are allowed")
def test_external_metadata_for_mutistatement_virtual_table(self):
self.login(username="******")
table = SqlaTable(
table_name="multistatement_sql_table",
database=get_example_database(),
sql="select 123 as intcol, 'abc' as strcol;"
"select 123 as intcol, 'abc' as strcol",
)
with db_insert_temp_object(table):
url = f"/datasource/external_metadata/table/{table.id}/"
resp = self.get_json_resp(url)
self.assertEqual(resp["error"], "Only single queries supported")