rusackas opened a new pull request, #43394: URL: https://github.com/apache/superset/pull/43394
### SUMMARY - SQL Lab query execution now re-authorizes against the literal rendered SQL immediately before running it, instead of authorizing one render and executing a second, independent render — closing the gap where a nondeterministic Jinja template could authorize against one table and execute against another. - The SQL executor's result cache is now scoped by effective user identity for connections where that identity varies per user (impersonation/OAuth2), instead of being shared across all callers of the same database connection. - The legacy `kv:`-prefixed SQL Lab permalink resolution path (a raw sequential-ID lookup with no ownership check) has been removed; only the salted-hashid permalink store remains. - Jinja's `escaped_val`/`url_param` now render escaped list/dict values through a wrapper that doesn't reintroduce Python's own `repr()`-added quote delimiters around already-escaped elements. ### TESTING INSTRUCTIONS `pytest tests/unit_tests/jinja_context_test.py tests/unit_tests/sql/execution/test_executor.py tests/unit_tests/commands/sql_lab/` — new/extended tests per change, each verified to fail pre-fix and pass post-fix. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
