Unknown column used in orderby for SQL expression columns (server-side pagination)

[wuqicyber]

Bug description

Summary

When using server-side pagination in a table chart and attempting to sort by a custom SQL expression column (adhoc column), the API returns a 400 error:

This issue only occurs with server-side pagination enabled, where sorting is handled by the backend rather than the frontend.

Steps to Reproduce

1. Create a table chart with server-side pagination enabled
2. Add a custom SQL expression column:

3. Click on the adhoc column header to sort by it 4. The API receives an orderby clause referencing the adhoc column by its label: { "orderby": [["new_rank_name", false]] } 5. API returns 400 error

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.10

Node version

18 or greater

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

This error happens because Superset now enforces strict backend validation for sorting: the ORDER BY clause must reference known columns or metrics, not freeform SQL or adhoc column labels. This change prevents SQL injection and data exfiltration, and only allows sorting by columns visible in the chart (columns, groupby, or metrics) source.

Recent fixes in PR #35342 and #35482 (merged after October 2025) update how adhoc SQL expression columns are handled in ORDER BY clauses, so upgrading to the latest master/dev branch should resolve this issue source source.

If you can't upgrade, there are no official workarounds to restore the old freeform SQL sorting. For complex sorting, create a calculated column or metric in your dataset and sort by that. For multi-field sorting, you can pre-sort data in your database, create a calculated column encoding your desired order, or modify the frontend to send all selected sort fields to the backend, but there’s no built-in UI support for this source.

Let me know if you need more technical details or code references!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}