Revert pr 2025#2041
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request simplifies SQL query generation in aggregation_utils.py by removing single-quote escaping on import_names and hardcoding the 'dc/base/' prefix and 'dc/base/GeneratedGraphs' provenance. The reviewer points out that these changes introduce critical SQL injection vulnerabilities because user-controlled input is no longer escaped. Additionally, hardcoding the base prefix breaks functionality for non-base Data Commons instances where self.is_base_dc is False.
|
Thanks Christie! @SandeepTuniki Can you (and Vishal) pls take over reverting this PR + making the dataflow work without adding dc/base ? You can now test the e2e DCP setup to ensure this will work :) |
|
I resolved all the comments even though they are real injection vulnerabilities. Sandeep, when you take this over, can you ensure to re-resolve the vulns? |
2 participants
This is a reversion of #2025, however, I just kept the env varaible propagated through.