[sha174n]

SUMMARY

check_sqlalchemy_uri() blocks a fixed set of SQLAlchemy dialects (sqlite, shillelagh, duckdb) because they can resolve local filesystem paths at query time. Today the only lever an operator has to relax that is PREVENT_UNSAFE_DB_CONNECTIONS=False, which disables the whole check. That is all-or-nothing: an operator who deliberately runs duckdb/MotherDuck has to drop the guard for every other dialect too.

This PR adds per-dialect granularity. A new config setting lets an operator opt a specific dialect back in while the rest of the blocklist keeps applying.

Mechanism

• New config ALLOWED_UNSAFE_DB_DIALECTS: set[str] = set() (next to PREVENT_UNSAFE_DB_CONNECTIONS). It holds base dialect names, the part of the drivername before any +driver.
• In check_sqlalchemy_uri(), when a blocklist entry matches, the base dialect is compared against the allowlist; if the operator listed it, that one dialect is permitted and the loop moves on. Everything else (the superset/ENABLE_SUPERSET_META_DB handling, the raised error) is unchanged.
• Entries are matched on the base dialect, lower-cased and with any +driver suffix and surrounding whitespace stripped, so duckdb, DuckDB and duckdb+duckdb_engine all opt in the duckdb dialect (and the MotherDuck cloud URI, which rides the same dialect). A None/unset value is treated as no allowlist. This mirrors how the blocklist regexes already treat +driver suffixes.
• The allowlist only covers the filesystem dialects it is meant to relax (sqlite, shillelagh, duckdb, via ALLOWLISTABLE_DIALECTS). The feature-flag-gated superset meta-database block is deliberately excluded, so this setting cannot be used to bypass ENABLE_SUPERSET_META_DB, and a future blocklist entry is not allowlistable unless added on purpose.

Backward compatibility

Defaults to an empty set, so behaviour is identical to today unless an operator explicitly opts a dialect in. No effect when PREVENT_UNSAFE_DB_CONNECTIONS is False (the check is skipped entirely in that case). This complements the existing all-or-nothing flag rather than replacing it.

TESTING INSTRUCTIONS

tests/integration_tests/security/analytics_db_safety_tests.py adds coverage through the real check_sqlalchemy_uri (no mocking of the check):

• a dialect added to ALLOWED_UNSAFE_DB_DIALECTS is accepted, including the MotherDuck URI and the +duckdb_engine driver;
• allowing one dialect does not re-enable the others (per-dialect, not global);
• the default empty allowlist preserves existing behaviour.

pytest tests/integration_tests/security/analytics_db_safety_tests.py

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
• Migration is atomic, supports rollback & is backwards-compatible
• Confirm DB migration upgrade and downgrade tested
• Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.28%. Comparing base (a6f30aa) to head (c8fbd6b).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #45020      +/-   ##
==========================================
- Coverage   65.35%   65.28%   -0.07%     
==========================================
  Files        3083     3083              
  Lines      211333   211339       +6     
  Branches    49823    49824       +1     
==========================================
- Hits       138110   137983     -127     
- Misses      70041    70170     +129     
- Partials     3182     3186       +4     

Flag	Coverage Δ
hive	34.05% <50.00%> (+<0.01%)	⬆️
mysql	51.81% <100.00%> (+<0.01%)	⬆️
postgres	?
presto	35.69% <50.00%> (+<0.01%)	⬆️
python	52.02% <100.00%> (-0.11%)	⬇️
sqlite	51.52% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codeant-ai-for-open-source]

  CodeAnt PR Risk

🟢  Low Risk

• The PR appears safe to merge; no actionable issues were identified in the review.

Assessed commit: c8fbd6b3fd69

[netlify]

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	76fea0f
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6ac53ecadb425900088dee13
😎 Deploy Preview	https://deploy-preview-45020--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.