rusackas opened a new pull request, #40657: URL: https://github.com/apache/superset/pull/40657
### SUMMARY Two correctness/security defects in `ReportSuccessState.next()` (`superset/commands/report/execute.py`), both diverging from the robust pattern already used by the sibling `ReportNotTriggeredErrorState.next()`: 1. **Concurrent execution / duplicate notifications (CWE-362).** The WORKING-state guard blocks a concurrent scheduler tick from re-running a report. It's set before `send()` for ALERT types and on the not-triggered/error path, but **not for REPORT types in the SUCCESS/GRACE state** — they go straight to `send()` with no WORKING marker. A second scheduler tick (which sees `last_state == SUCCESS` and routes back into `ReportSuccessState`) is therefore not blocked, allowing duplicate sends. Now sets WORKING before `send()` for REPORT types too. 2. **Stuck WORKING state (CWE-755).** In the ALERT error path, if `send_error()` itself raises, the `ERROR`-state transition was skipped, leaving the schedule stuck in WORKING until the working timeout. `send_error()` is now wrapped so the `ERROR` transition always runs (and a logging failure there is swallowed), mirroring the sibling's `finally` pattern. ### TESTING INSTRUCTIONS ``` pytest tests/unit_tests/commands/report/execute_test.py ``` Updated `test_success_state_report_sends_and_logs_success` to expect `WORKING` → `SUCCESS`; added `test_success_state_error_logged_when_send_error_raises` asserting ERROR is logged even when `send_error()` raises. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
