bito-code-review[bot] commented on PR #42936:
URL: https://github.com/apache/superset/pull/42936#issuecomment-5232431423
<!-- Bito Reply -->
The flagged security issue is correct. The current implementation in
`superset/views/datasource/views.py` evaluates access using the existing
dataset's table, schema, and catalog, but then updates the `database_id`
without verifying if the user has access to the *new* database with the
*requested* table, schema, and catalog.
To resolve this, you should construct the `Table` object using the values
from the request payload (or the new target) before calling
`security_manager.raise_for_access`.
Here is the corrected logic for `superset/views/datasource/views.py`:
```python
if database_id != orm_datasource.database_id:
new_database = DatasetDAO.get_database_by_id(database_id)
if new_database is None:
return json_error_response(_("Database not found."),
status=422)
try:
security_manager.raise_for_access(
database=new_database,
table=Table(
request.json.get("table_name",
orm_datasource.table_name),
request.json.get("schema", orm_datasource.schema),
request.json.get("catalog", orm_datasource.catalog),
),
)
except SupersetSecurityException as ex:
raise DatasetForbiddenError() from ex
orm_datasource.database_id = database_id
```
Would you like me to fetch all other comments on this PR to validate and
implement fixes for them as well?
**superset/views/datasource/views.py**
```
if database_id != orm_datasource.database_id:
new_database = DatasetDAO.get_database_by_id(database_id)
if new_database is None:
return json_error_response(_("Database not found."),
status=422)
try:
security_manager.raise_for_access(
database=new_database,
table=Table(
request.json.get("table_name",
orm_datasource.table_name),
request.json.get("schema", orm_datasource.schema),
request.json.get("catalog", orm_datasource.catalog),
),
)
except SupersetSecurityException as ex:
raise DatasetForbiddenError() from ex
orm_datasource.database_id = database_id
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
