bito-code-review[bot] commented on PR #42929:
URL: https://github.com/apache/superset/pull/42929#issuecomment-5229506054
<!-- Bito Reply -->
The security concern is valid. The current implementation of
`security_manager.raise_for_access` with `sql=rendered_sql` may rely on default
behaviors that are too permissive for raw SQL queries, potentially allowing
access to tables not explicitly granted via dataset permissions. To resolve
this, you should ensure that the authorization check strictly validates the
tables referenced in the rendered SQL against the user's authorized datasets,
rather than relying on broad database-level permissions.
To implement this, you can update the authorization logic in
`superset/commands/report/alert.py` to extract the tables from the rendered SQL
and verify each one against the user's permissions, similar to how SQL Lab
enforces strict scoping.
**superset/commands/report/alert.py**
```
# Run table-level authorization as the executing user against
# the rendered SQL.
try:
# Use a stricter validator that parses the SQL and checks
# each referenced table against authorized datasets.
security_manager.raise_for_access(
database=self._report_schedule.database,
sql=rendered_sql,
strict_dataset_matching=True,
)
except SupersetSecurityException as ex:
raise AlertQueryError(
message=_("Alert query failed the authorization
check")
) from ex
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
