Metric Attribute Explorer

[MikeShi42]

Fixes HDX-2282

[changeset-bot]

🦋 Changeset detected

Latest commit: f7c0e4c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@hyperdx/app	Minor
@hyperdx/api	Minor
@hyperdx/otel-collector	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hyperdx-v2-oss-app	Ready	Preview, Comment	Feb 6, 2026 3:33pm

[claude]

PR Review: Metric Attribute Explorer

Critical Issues

• 🔒 SQL Injection vulnerability in formatWhereClause (MetricAttributeHelperPanel.tsx:148) → Escape single quotes in name and value parameters before string interpolation
• 🔒 SQL Injection vulnerability in formatGroupByClause (MetricAttributeHelperPanel.tsx:159) → Escape single quotes in name parameter before string interpolation

Important Issues

• ⚠️ Missing databaseName in query key (useFetchMetricMetadata.tsx:49) → Add tableSource to query key for proper cache isolation
• ⚠️ Missing databaseName in query key (useFetchMetricAttributeValues.tsx:58-66) → Add databaseName to query key for proper cache isolation
• ⚠️ Component exceeds 300 lines (MetricAttributeHelperPanel.tsx:493 lines) → Split into separate files per project guidelines

Notes

The feature looks good overall - nice UI/UX implementation with proper debouncing, loading states, and React Query integration. The parameterized queries in the ClickHouse hooks are properly done. Main concerns are the string interpolation in the WHERE/GROUP BY clause formatters that could allow SQL injection if values contain quotes.

[github-actions]

E2E Test Results

✅ All tests passed • 64 passed • 4 skipped • 792s

Status	Count
✅ Passed	64
❌ Failed	0
⚠️ Flaky	0
⏭️ Skipped	4

Tests ran across 4 shards in parallel.

View full report →

[pulpdrew]

This looks great, just a couple of minor comments!

Also one behavior that was unexpected was that anytime the query is submitted (including when adding a filter or group by using this panel), the helper panel is collapsed. Is that intentional?

[pulpdrew]

LGTM