fix: add more disallowed pg functions

apache · Jul 2, 2024 · 08ed138 · 08ed138
1 parent 7f3c8ef
commit 08ed138
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/superset/config.py b/superset/config.py
@@ -1274,7 +1274,15 @@ def CSV_TO_HIVE_UPLOAD_DIRECTORY_FUNC(  # pylint: disable=invalid-name
 # unsafe SQL functions in SQL Lab and Charts. The keys of the dictionary are the engine
 # names, and the values are sets of disallowed functions.
 DISALLOWED_SQL_FUNCTIONS: dict[str, set[str]] = {
-    "postgresql": {"version", "query_to_xml", "inet_server_addr", "inet_client_addr"},
+    "postgresql": {
+        "version",
+        "query_to_xml",
+        "inet_server_addr",
+        "inet_client_addr",
+        "query_to_xml_and_xmlschema",
+        "table_to_xml",
+        "table_to_xml_and_xmlschema",
+    },
     "clickhouse": {"url"},
     "mysql": {"version"},
 }