sha174n commented on PR #43388: URL: https://github.com/apache/superset/pull/43388#issuecomment-5382019895
Solid fail-closed hardening across the auth and request-validation paths, and gating response caching behind an explicit cross-principal opt-in is the right call. A few things before merge: (1) find_users: dropping the email column still leaves username.ilike, and since usernames can be email addresses (common with OAuth provisioning), an email-shaped query still matches by username; consider rejecting email-shaped input so the intended non-matching behavior actually holds, with a regression test. (2) Even with the cross-principal opt-in, the caching middleware exclusions do not cover mutating tools (restore_chart/restore_dashboard/execute_sql), so a repeated identical call within the TTL could return a cached result without re-running the handler; suggest limiting caching to an explicit read-only allowlist. (3) MCP_DEV_USERNAME + auth and JWT-enabled-without-keys now refuse startup, which the README still presents as valid configs; worth a docs/upgrade note. Also needs a rebase o n master (currently conflicting). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
