khaa-dv opened a new issue, #43576:
URL: https://github.com/apache/superset/issues/43576
### Bug description
Any embedded dashboard chart whose form control stores a single value as a
bare string rather than a one-item list is permanently rejected for guest
users, even when the guest requests exactly the chart's own saved data with no
modification whatsoever.
`heatmap_v2` is the clearest example: its "Group by" control stores a single
column name directly as a string (e.g. `"my_column"`), not as a one-item list —
unlike most other viz types, whose equivalent controls (`groupby`, `columns`,
`entity`, etc.) are always lists.
The guest-payload tamper check in `superset/security/manager.py`
(`_columns_metrics_modified`, called from `query_context_modified`) iterates
the requested value directly:
```python
requested_values = {
_payload_value_identity(value, is_metric=is_metric)
for value in form_data.get(key) or []
}
```
and similarly:
```python
queries_values = {
_payload_value_identity(value, is_metric=is_metric)
for query in query_context.queries
for value in getattr(query, key, []) or []
}
```
Neither site checks whether the value is actually a list before iterating
it. When `form_data.get("groupby")` (or the equivalent `QueryObject` attribute)
is a plain string, Python iterates it character by character, so e.g.
`"my_column"` becomes the set `{"m", "y", "_", "c", "o", "l", "u", "m", "n"}`
instead of `{"my_column"}`. This is of course never a subset of anything the
chart actually has stored, so the guest request is rejected with:
```
Guest user cannot modify chart payload
```
This affects every guest request for the chart, regardless of whether
anything was actually changed — the chart is simply unusable when embedded.
### How to reproduce the bug
1. Create a heatmap_v2 chart on any dataset, selecting a single column for
the "Group by" control.
2. Add the chart to a dashboard and enable embedding for that dashboard.
3. Generate a guest token and load the dashboard through the embedded SDK.
4. Open embedded dashboard. The chart fails to load with "Data error: Guest
user cannot modify chart payload" (screenshot 1).
### Screenshots/recordings
The same chart (`test_heatmap`) rendering correctly for a regular
(non-guest) user on the standard dashboard view.
<img width="1879" height="955" alt="Image"
src="https://github.com/user-attachments/assets/841e02ea-a50e-4187-8f65-0f20962a2f5c";
/>
Embedded dashboard showing the "Data error: Guest user cannot modify chart
payload" message for the `test_heatmap `chart.
<img width="1871" height="748" alt="Image"
src="https://github.com/user-attachments/assets/79234193-8bd7-4bd3-bd33-76fc63fd9623";
/>
Browser DevTools Network tab, request Payload for the failing `POST
/api/v1/chart/data` call, showing `form_data.groupby: "division"` (scalar
string) and the matching `queries[0].columns` array.
<img width="1876" height="787" alt="Image"
src="https://github.com/user-attachments/assets/58d7fbc3-463a-4d12-85cc-720532081474";
/>
Server debug log confirming the exact comparison that fails:
`requested_values(form_data)` decomposed into individual characters of
`"division"` instead of the single value.
<img width="1783" height="204" alt="Image"
src="https://github.com/user-attachments/assets/e9ff149e-e01b-4037-83fe-d18f22e03cb9";
/>
### Superset version
master / latest-dev
### Python version
3.12
### Node version
16
### Browser
Chrome
### Additional context
Found while debugging why every heatmap_v2 chart on an embedded dashboard
failed to load for guest users while charts of other viz types (whose
equivalent controls are always lists) worked fine. A fix (guard every iteration
site with a small _ensure_list() helper) plus regression tests is ready —
opening a PR right after this issue (will link it here once opened).
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to
my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug
report.
- [x] I have checked Superset's logs for errors and if I found a relevant
Python stacktrace, I included it here as text in the "additional context"
section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
