fix: User-provided Jinja template parameters causing SQL parsing errors

[michael-s-molina]

SUMMARY

Fixes a bug where user-provided Jinja template parameters were not being properly threaded through the SQL processing pipeline, causing parsing errors and security validation failures.

🐛 Problem

When users provided custom Jinja template parameters (e.g., {"table_name": "my_table"}), these parameters were not being passed to the Jinja template processor during SQL parsing and security validation. This caused:

• SQL parsing errors when templates couldn't resolve variables
• Security validation failures when table extraction failed
  -Inconsistent behavior between SQL execution and validation phases

🔧 Solution

• Enhanced parameter threading: Added template_params parameter throughout the call stack from SQL execution to security validation
• API improvements: Refactored extract_tables_from_jinja_sql → process_jinja_sql with structured return type for better maintainability

TESTING INSTRUCTIONS

1. Open SQL Lab
2. Create a query with Jinja template variables:

SELECT * FROM {{ table_name }} 
WHERE status = '{{ status_filter }}'

3. Add template parameters in the "Template Parameters" field:

{
  "table_name": "your_table_name",
  "status_filter": "active"
}

4. Expected: Query should execute successfully without parsing errors
5. Before fix: Would fail with parsing errors

cc @jamra

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[korbit-ai]

Review by Korbit AI

Korbit automatically attempts to detect when you fix issues in new commits.

Category	Issue	Status
	Wrong Optional Import Source ▹ view	✅ Fix detected

Files scanned

​

File Path	Reviewed
superset/sqllab/validators.py	✅
superset/commands/sql_lab/execute.py	✅
superset/db_engine_specs/postgres.py	✅
superset/models/sql_lab.py	✅
superset/sql/parse.py	✅
superset/models/core.py	✅
superset/db_engine_specs/base.py	✅
superset/security/manager.py	✅

Explore our documentation to understand the languages and file types we support and the files we ignore.

Check out our docs on how you can make Korbit work best for you and your team.

Loving Korbit!? Share us on LinkedIn Reddit and X

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.94%. Comparing base (48699a7) to head (8b84864).
⚠️ Report is 823 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #34802       +/-   ##
===========================================
+ Coverage        0   72.94%   +72.94%     
===========================================
  Files           0      574      +574     
  Lines           0    42014    +42014     
  Branches        0     4427     +4427     
===========================================
+ Hits            0    30646    +30646     
- Misses          0    10188    +10188     
- Partials        0     1180     +1180     

Flag	Coverage Δ
hive	47.17% <92.30%> (?)
mysql	71.94% <92.30%> (?)
postgres	72.01% <100.00%> (?)
presto	50.86% <92.30%> (?)
python	72.90% <100.00%> (?)
sqlite	71.56% <92.30%> (?)
unit	100.00% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[justinpark]

LGTM

[jamra]

Why do we need to propagate template_params if we already do the jinja processing here? Is it for the table extraction method?

[michael-s-molina]

The super API defines a parameter for template_params which is not used currently in the base implementation but could be used in the future.

[jamra]

<3 this approach. Process the Jinja then extract tables. Doesn't this also need the template params though?

[michael-s-molina]

It would but this function looks to be only invoked from dead code that should be removed.