FQE-1719- Validate HubSpot Handler

[setohe0909]

Frontend PR --> #3285

Fixes FQE-1719

Type of change

• 🐛 Bug fix (non-breaking change which fixes an issue)

Verification Process

To ensure the changes are working as expected:

• Test Location: Specify the URL or path for testing.
• Verification Steps: Outline the steps or queries needed to validate the change. Include any data, configurations, or actions required to reproduce or see the new functionality.

Unit tests

Checklist:

• My code follows the style guidelines(PEP 8) of MindsDB.
• I have appropriately commented on my code, especially in complex areas.
• Necessary documentation updates are either made or tracked in issues.
• Relevant unit and integration tests are updated or added.

[entelligence-ai-pr-reviews]

🔒 Entelligence AI Vulnerability Scanner

✅ No security vulnerabilities found!

Your code passed our comprehensive security analysis.

---

[entelligence-ai-pr-reviews]

Review Summary

🏷️ Draft Comments (2)

Skipped posting 2 draft comments that were valid but scored below your review threshold (>=13/15). Feel free to update them here.

mindsdb/integrations/handlers/mssql_handler/mssql_handler.py (2)

59-152: _make_table_response is a large, highly complex function (22 branches, 61 statements) that is difficult to maintain and optimize, increasing risk of performance and maintainability issues as code evolves.

📊 Impact Scores:

• Production Impact: 2/5
• Fix Specificity: 4/5
• Urgency Impact: 2/5
• Total Score: 8/15

🤖 AI Agent Prompt (Copy & Paste Ready):

Refactor the function `_make_table_response` in mindsdb/integrations/handlers/mssql_handler/mssql_handler.py (lines 59-152) to reduce its cyclomatic complexity and improve maintainability. Extract the MySQL type inference logic into a separate helper function (e.g., `_infer_mysql_types`). Ensure the refactored code preserves all original logic and formatting, and that the main function is significantly simplified.

---

489-491: table_names in meta_get_tables is interpolated into SQL without sanitization, enabling SQL injection and unauthorized data access.

📊 Impact Scores:

• Production Impact: 5/5
• Fix Specificity: 3/5
• Urgency Impact: 4/5
• Total Score: 12/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In mindsdb/integrations/handlers/mssql_handler/mssql_handler.py, lines 489-491, the `meta_get_tables` method interpolates `table_names` directly into the SQL query, which is vulnerable to SQL injection. Refactor this to use parameterized queries: generate the correct number of placeholders (`?`) and pass `table_names` as parameters to the query execution.

---

🔍 Comments beyond diff scope (1)

mindsdb/integrations/handlers/mssql_handler/mssql_handler.py (1)

430-448: table_name in get_columns is interpolated directly into SQL without sanitization, allowing SQL injection and unauthorized data access.
Category: security

---

[entelligence-ai-pr-reviews]

Review Summary

🏷️ Draft Comments (1)

Skipped posting 1 draft comments that were valid but scored below your review threshold (>=13/15). Feel free to update them here.

mindsdb/integrations/handlers/gong_handler/__init__.py (1)

16-16: type is assigned as a module-level variable, shadowing the Python built-in type, which can cause unexpected runtime errors if the built-in is needed later.

📊 Impact Scores:

• Production Impact: 2/5
• Fix Specificity: 3/5
• Urgency Impact: 2/5
• Total Score: 7/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In mindsdb/integrations/handlers/gong_handler/__init__.py, line 16, the variable `type` is assigned, which shadows the Python built-in `type`. This can cause unexpected runtime errors if the built-in is needed later. Please rename this variable to `handler_type` and update all references accordingly.

---

[entelligence-ai-pr-reviews]

Review Summary

🏷️ Draft Comments (1)

Skipped posting 1 draft comments that were valid but scored below your review threshold (>=13/15). Feel free to update them here.

mindsdb/integrations/handlers/hubspot_handler/hubspot_handler.py (1)

57-59: access_token is retrieved directly from self.connection_data without validation, allowing attackers to supply malicious or invalid tokens and potentially access unauthorized HubSpot accounts.

📊 Impact Scores:

• Production Impact: 3/5
• Fix Specificity: 4/5
• Urgency Impact: 3/5
• Total Score: 10/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In mindsdb/integrations/handlers/hubspot_handler/hubspot_handler.py, lines 57-59, the code retrieves `access_token` directly from `self.connection_data` without validation, which could allow attackers to supply malicious or invalid tokens and potentially access unauthorized HubSpot accounts. Update this section to validate that the access token is a non-empty string of reasonable length (e.g., at least 20 characters) before using it to initialize the HubSpot client. Raise a ValueError if the token is invalid.

---

[entelligence-ai-pr-reviews]

🚀 Code Review Initiated

The review process for this pull request has started. Our system is analyzing the changes for:

• Code quality, performance, and potential issues
• Adherence to project guidelines
• Integration of user-provided learnings

You will receive structured and actionable feedback shortly! ⏳

[entelligence-ai-pr-reviews]

Review Summary

🏷️ Draft Comments (3)

Skipped posting 3 draft comments that were valid but scored below your review threshold (>=13/15). Feel free to update them here.

mindsdb/integrations/handlers/hubspot_handler/hubspot_handler.py (1)

79-79: In check_connection, assigning response.error_message = e stores an Exception object instead of a string, which may break consumers expecting a string error message.

📊 Impact Scores:

• Production Impact: 3/5
• Fix Specificity: 5/5
• Urgency Impact: 2/5
• Total Score: 10/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In mindsdb/integrations/handlers/hubspot_handler/hubspot_handler.py, line 79, the code assigns the Exception object directly to response.error_message. This can cause issues if consumers expect a string. Change it to assign str(e) instead.

---

mindsdb/integrations/handlers/hubspot_handler/hubspot_tables.py (2)

280-280: In the ContactsTable.insert method, supported_columns contains duplicate 'firstname' keys, which may cause incorrect parsing or data loss for the 'firstname' field.

📊 Impact Scores:

• Production Impact: 2/5
• Fix Specificity: 5/5
• Urgency Impact: 2/5
• Total Score: 9/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In mindsdb/integrations/handlers/hubspot_handler/hubspot_tables.py, line 280, remove the duplicate 'firstname' entry from the `supported_columns` list in the `ContactsTable.insert` method to prevent incorrect parsing or data loss.

---

31-589: Substantial code duplication exists across CompaniesTable, ContactsTable, and DealsTable for CRUD logic, increasing maintenance burden and risk of inconsistent behavior.

📊 Impact Scores:

• Production Impact: 2/5
• Fix Specificity: 2/5
• Urgency Impact: 2/5
• Total Score: 6/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In mindsdb/integrations/handlers/hubspot_handler/hubspot_tables.py, lines 31-589, there is substantial code duplication across `CompaniesTable`, `ContactsTable`, and `DealsTable` for CRUD operations (select, insert, update, delete, and helper methods). Refactor the code to extract common logic into reusable base classes or utility functions to reduce duplication, improve maintainability, and ensure consistent error handling and API usage.

---

🔍 Comments beyond diff scope (1)

mindsdb/integrations/handlers/hubspot_handler/hubspot_handler.py (1)

57-57: self.connection_data['access_token'] in connect() will raise KeyError if 'access_token' is missing, causing an unhandled exception and crash.
Category: correctness

---

[entelligence-ai-pr-reviews]

Review Summary

🏷️ Draft Comments (1)

Skipped posting 1 draft comments that were valid but scored below your review threshold (>=13/15). Feel free to update them here.

mindsdb/integrations/handlers/hubspot_handler/hubspot_handler.py (1)

57-57: self.connection_data['access_token'] in connect() will raise a KeyError if 'access_token' is missing, causing a crash instead of a controlled error.

📊 Impact Scores:

• Production Impact: 4/5
• Fix Specificity: 5/5
• Urgency Impact: 3/5
• Total Score: 12/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In mindsdb/integrations/handlers/hubspot_handler/hubspot_handler.py, lines 57-57, the code directly accesses 'access_token' from self.connection_data, which will raise a KeyError if the key is missing. Replace this with a .get() call and raise a ValueError with a clear message if the token is missing, to prevent unhandled exceptions and provide a controlled error.

---

[entelligence-ai-pr-reviews]

Review Summary

🏷️ Draft Comments (2)

Skipped posting 2 draft comments that were valid but scored below your review threshold (>=13/15). Feel free to update them here.

mindsdb/utilities/render/sqlalchemy_render.py (2)

180-407: to_expression (lines 180-407) is a single, extremely large function with high cyclomatic complexity, making it difficult to maintain and optimize, and increasing risk of performance regressions as the codebase grows.

📊 Impact Scores:

• Production Impact: 2/5
• Fix Specificity: 4/5
• Urgency Impact: 2/5
• Total Score: 8/15

🤖 AI Agent Prompt (Copy & Paste Ready):

Refactor the `to_expression` method in mindsdb/utilities/render/sqlalchemy_render.py (lines 180-407). The function is excessively large and complex, making it hard to maintain and optimize. Break it into smaller, well-named helper methods for each major AST node type (e.g., handle_constant, handle_identifier, handle_binary_operation, etc.), and delegate logic accordingly. This will improve maintainability, testability, and reduce risk of performance regressions.

---

518-655: prepare_select (lines 518-655) is a very large, complex function with many branches and statements, making it hard to maintain and optimize for performance as query logic evolves.

📊 Impact Scores:

• Production Impact: 2/5
• Fix Specificity: 4/5
• Urgency Impact: 2/5
• Total Score: 8/15

🤖 AI Agent Prompt (Copy & Paste Ready):

Refactor the `prepare_select` method in mindsdb/utilities/render/sqlalchemy_render.py (lines 518-655). The function is too large and complex, with many branches and statements. Break it into smaller helper methods for each major clause (e.g., handle_from, handle_joins, handle_group_by, handle_order_by, etc.), and delegate logic accordingly. This will improve maintainability, testability, and reduce risk of performance bottlenecks as query logic grows.

---

[StpMax]

With limit=100 it will return max 100 for this value. May be use another endpoint? Here described Returns the total number of contacts in the account and the date of the last contact add.. The same for other tables.

[StpMax]

Could this information be misleading for the LLM? This stats is calculated basing only on piece of data, so min/max values - is not real min/max values

[StpMax]

We show this columns in table information_schema.columns. Columns list should be the same as in the information_schame.columns table, statistic there is not necessary. Check here and here for reference

[StpMax]

Check methods meta_get_columns and meta_get_column_statistics from here to get required fields list

[StpMax]

To work with data catalog, handler's class should be inherited from MetaApiHandler