FrancescoCastaldi opened a new pull request, #43697:
URL: https://github.com/apache/superset/pull/43697
### Summary
This PR addresses **Issue #43576** (Guest embedded dashboard payload
rejection on charts storing single-value scalar controls such as `heatmap_v2`)
and strengthens security manager tamper checks and dialect test coverage across
Superset.
### Problem Fixed (Issue #43576)
Embedded dashboard charts whose controls store a single scalar string value
(e.g. `groupby: "division"`) rather than a list were previously iterated
directly as iterables in `_columns_metrics_modified` and related helpers in
`superset/security/manager.py`. This caused Python to decompose the string
character-by-character (e.g. `{"d", "i", "v", "s", "o", "n"}`), resulting in a
false-positive rejection ("*Guest user cannot modify chart payload*").
### Key Changes
1. **Security Manager (`superset/security/manager.py`)**:
- Introduced `_ensure_list` helper to safely normalize scalar values
(strings, numbers, dicts), sequences, and nulls.
- Guarded `_columns_metrics_modified`, `_stored_param_values`,
`_native_filter_query_modified`, `_collect_stored_orderby_entries`, and
`_sql_filters_modified` to prevent character-level iteration bugs.
2. **Security Unit Tests (`tests/unit_tests/security/manager_test.py`)**:
- Added unit tests validating scalar groupby controls (e.g.,
`heatmap_v2`).
- Added unit tests validating scalar columns, metrics, and query
validation.
3. **Database Engine Specs Unit Test Coverage**:
- Added and expanded unit test suites for OceanBase, CockroachDB,
Firebolt, MongoDB, Google Sheets, Azure Synapse, MotherDuck, and Amazon
DynamoDB specs in `tests/unit_tests/db_engine_specs/`.
### Testing Instructions
- Run `pytest tests/unit_tests/security/manager_test.py`
- Run `pytest tests/unit_tests/db_engine_specs/`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
