sha174n opened a new pull request, #43998: URL: https://github.com/apache/superset/pull/43998
The MCP `execute_sql` tool validated access to the database connection but did not apply the dataset/table-level access validation that the SQL Lab execution path performs (`raise_for_access(..., force_dataset_match=True)`). As a result the two execution surfaces could authorize the tables a query references differently. This adds the same table-access validation to `execute_sql`, called before the query runs, so a query that references tables the user is not granted is rejected consistently with SQL Lab. It uses the canonical `security_manager.raise_for_access` entry point (passing `database`/`sql`/`catalog`/`schema`/`template_params`), returns a `TABLE_SECURITY_ACCESS_ERROR` response on denial, and leaves the destructive-DDL check and execution steps unchanged. Adds a unit test asserting a query referencing an unauthorized table is denied and never executed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
