fix(cdp): throw if select in filters

[mariusandra]

Problem

Turns out you can write subqueries in HogQL filters in data pipelines.

Changes

Throws an error when saving the filter, not later during runtime.

How did you test this code?

In the browser and added a test

[greptile-apps]

PR Summary

This PR adds a security check to prevent SQL injection via subqueries in HogQL filters for data pipelines.

• Added SelectFinder visitor class in posthog/cdp/filters.py to detect SELECT queries in filter ASTs
• Modified compile_filters_bytecode to throw early error during filter saving rather than at runtime
• Added test case test_filters_raises_on_select in posthog/cdp/test/test_filters.py to verify SELECT detection
• Error message could be more specific about why SELECT queries are not allowed in filters

_{2 file(s) reviewed, 3 comment(s)
Edit PR Review Bot Settings | Greptile}

[greptile-apps]

style: Generic Exception is too broad. Consider creating a specific exception type for filter validation errors.

[greptile-apps]

logic: visit_select_query() should call super().visit_select_query(node) to ensure proper traversal of child nodes

[greptile-apps]

logic: found should be instance-specific, not class-level, to avoid state sharing between instances

Suggested change

	class SelectFinder(TraversingVisitor):
	found = False
	class SelectFinder(TraversingVisitor):
	def __init__(self):
	super().__init__()
	self.found = False