codeant-ai-for-open-source[bot] commented on code in PR #43402: URL: https://github.com/apache/superset/pull/43402#discussion_r3832930194
########## superset/commands/chart/delete.py: ########## @@ -32,11 +33,62 @@ from superset.daos.report import ReportScheduleDAO from superset.exceptions import SupersetSecurityException from superset.models.slice import Slice +from superset.reports.models import ReportSchedule from superset.utils.decorators import on_error, transaction logger = logging.getLogger(__name__) +def build_blocked_by_reports_message( + charts: list[Slice], + reports: list[ReportSchedule], + single_target: bool, +) -> str: + """Build the user-facing message naming the alerts/reports that block deletion. + + Groups the blocking reports per chart, sorted by chart name (chart id as + the tie-breaker) and then report name so the message is deterministic + across database backends, and appends the remedy sentence. When the + command targets a single chart id the group prefix is dropped — in the + single-delete endpoint the surrounding toast already names the chart, and + in a one-chart bulk selection the user's own selection provides the + context. A multi-id command keeps the prefix on every group because the + bulk toast is generic, so the prefix is the only chart identification the + user gets. + """ + sentences: list[str] = [] + if single_target: + names = sorted(report.name for report in reports) + sentences.append( + str( + _( + "This chart is used by alerts or reports: %(names)s.", + names=", ".join(names), + ) + ) + ) Review Comment: **Suggestion:** The deletion guard retrieves reports without applying `ReportScheduleFilter`, but this new message exposes every returned report name to anyone who can invoke chart deletion. A chart editor may be allowed to delete the chart while lacking permission to view one of its reports, so the 422 response discloses report names across the report permission boundary. Build the message from permission-filtered reports or use a generic remedy message for reports the caller cannot access. [security] <details> <summary><b>Severity Level:</b> Major ⚠️</summary> ```mdx - ❌ Chart deletion 422 responses disclose inaccessible alert/report names. - ⚠️ Report names cross the separate report-editor permission boundary. - ⚠️ The same exception is also returned by the MCP delete flow. ``` </details> [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) <details> <summary><b>Prompt for AI Agent 🤖 </b></summary> ```mdx This is a comment left during a code review. **Path:** superset/commands/chart/delete.py **Line:** 61:69 **Comment:** *Security: The deletion guard retrieves reports without applying `ReportScheduleFilter`, but this new message exposes every returned report name to anyone who can invoke chart deletion. A chart editor may be allowed to delete the chart while lacking permission to view one of its reports, so the 422 response discloses report names across the report permission boundary. Build the message from permission-filtered reports or use a generic remedy message for reports the caller cannot access. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43402&comment_hash=8748c81b3a8a19cf9a3da2dede9fb613c600bf87afbc79e5aec461bdad9c8542&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43402&comment_hash=8748c81b3a8a19cf9a3da2dede9fb613c600bf87afbc79e5aec461bdad9c8542&reaction=dislike'>👎</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
