{"record":{"id":"3c098a24a3cda8da","repo":"apache/superset","slug":"ex","errorCode":null,"errorMessage":"{ex}","messagePattern":"\\{ex\\}","errorType":"validation","errorClass":"ValidationError","httpStatus":422,"severity":"error","filePath":"superset/databases/schemas.py","lineNumber":226,"sourceCode":"    \"\"\"\n    Validate if it's a valid SQLAlchemy URI and refuse SQLLite by default\n    \"\"\"\n    try:\n        uri = make_url_safe(value.strip())\n    except DatabaseInvalidError as ex:\n        raise ValidationError(\n            [\n                _(\n                    \"Invalid connection string, a valid string usually follows: \"\n                    \"backend+driver://user:password@database-host/database-name\"\n                )\n            ]\n        ) from ex\n    if current_app.config.get(\"PREVENT_UNSAFE_DB_CONNECTIONS\", True):\n        try:\n            check_sqlalchemy_uri(uri)\n        except SupersetSecurityException as ex:\n            raise ValidationError([str(ex)]) from ex\n    return value\n\n\ndef server_cert_validator(value: str) -> str:\n    \"\"\"\n    Validate the server certificate\n    \"\"\"\n    if value:\n        try:\n            parse_ssl_cert(value)\n        except CertificateException as ex:\n            raise ValidationError([_(\"Invalid certificate\")]) from ex\n    return value\n\n\ndef encrypted_extra_validator(value: str | None) -> None:\n    \"\"\"\n    Validate that encrypted extra is a valid JSON string","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/databases/schemas.py#L208-L244","documentation":"The URI parsed fine, but check_sqlalchemy_uri raised SupersetSecurityException under PREVENT_UNSAFE_DB_CONNECTIONS (default true). The security check blocks connections that Superset treats as unsafe — notably SQLite and other file-based engines, plus hosts disallowed by configuration — and the exception message is surfaced verbatim as the validation error.","triggerScenarios":"Creating a database with sqlite:///path/to.db (or any engine the check blocks) while PREVENT_UNSAFE_DB_CONNECTIONS is enabled (the default); also connecting to a host on a blocked network segment when the check is extended by deployment config.","commonSituations":"Local/dev setups wanting a scratch SQLite database; CI importing fixtures; security hardening policies that forbid file-backed engines because they can read server files.","solutions":["Use a real client/server database (Postgres, MySQL, etc.) instead of SQLite when the guard is on.","If intentional and the deployment accepts the risk, set PREVENT_UNSAFE_DB_CONNECTIONS = False in superset_config.py (requires a Superset restart) — but understand it permits file-backed DBs.","Read the exact exception text: it states which aspect (engine type / host) was rejected."],"exampleFix":"# before\nsqlalchemy_uri: \"sqlite:///tmp/superset_dev.db\"  # rejected by default\n\n# after\nsqlalchemy_uri: \"postgresql+psycopg2://superset:pw@localhost:5432/superset\"\n# or, accepting the risk, in superset_config.py:\n# PREVENT_UNSAFE_DB_CONNECTIONS = False","handlingStrategy":"validation","validationCode":"from superset.utils.core import check_sqlalchemy_uri\nfrom sqlalchemy.engine import make_url\ntry:\n    check_sqlalchemy_uri(make_url(uri))\nexcept SupersetSecurityException as ex:\n    raise ValueError(f\"URI blocked by policy: {ex}\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default to client/server engines; avoid SQLite when PREVENT_UNSAFE_DB_CONNECTIONS is on.","Know your deployment's PREVENT_UNSAFE_DB_CONNECTIONS setting before scripting database creation."],"tags":["database","security","sqlite","configuration"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}