bito-code-review[bot] commented on PR #43998:
URL: https://github.com/apache/superset/pull/43998#issuecomment-5585361076
<!-- Bito Reply -->
The security concern is valid. In the current implementation,
`raise_for_access` with `force_dataset_match=True` is intended to validate
table-level access, but if the security manager configuration or the specific
`raise_for_access` implementation returns early for users with broad
database-level access, the subsequent table-level checks may be bypassed.
To resolve this, ensure that `raise_for_access` is configured to strictly
enforce table-level validation regardless of database-level permissions, or
explicitly perform the table-level check separately if `raise_for_access` is
insufficient for this requirement. Given the current implementation, you should
verify if `force_dataset_match=True` is correctly triggering the expected
validation logic in your security manager.
**superset/mcp_service/sql_lab/tool/execute_sql.py**
```
with
event_logger.log_context(action="mcp.execute_sql.table_access_validation"):
try:
security_manager.raise_for_access(
database=database,
sql=request.sql,
catalog=request.catalog,
schema=request.schema_name,
template_params=request.template_params,
force_dataset_match=True,
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
