bito-code-review[bot] commented on code in PR #43998:
URL: https://github.com/apache/superset/pull/43998#discussion_r3958269625
##########
superset/mcp_service/sql_lab/tool/execute_sql.py:
##########
@@ -171,6 +175,29 @@ async def execute_sql(request: ExecuteSqlRequest, ctx:
Context) -> ExecuteSqlRes
error_type=SupersetErrorType.DATABASE_SECURITY_ACCESS_ERROR.value,
)
+ # 1b. Enforce dataset/table-level access, matching the SQL Lab
+ # execution path (which calls raise_for_access(...,
force_dataset_match=
+ # True)). Access to the database connection alone does not authorize
+ # every table on it: the query must resolve to datasets the user is
+ # granted, so the tables it references are validated here before it
runs.
+ with
event_logger.log_context(action="mcp.execute_sql.table_access_validation"):
+ try:
+ security_manager.raise_for_access(
+ database=database,
+ sql=request.sql,
+ catalog=request.catalog,
+ schema=request.schema_name,
+ template_params=request.template_params,
+ force_dataset_match=True,
+ )
Review Comment:
<div>
<div id="suggestion">
<div id="issue"><b>CWE-863: Table Access Check No-Op</b></div>
<div id="fix">
This check never runs: `raise_for_access(database=..., sql=...)` builds an
ephemeral `Query`, enters the `if database and table or query:` branch, and
returns early at manager.py:4529 because `can_access_database(database)` is
already True (confirmed at line 168). So `force_dataset_match=True` is never
enforced and any table on the database is reachable. Match the SQL Lab path
(`sqllab/validators.py` passes `query=`) or add a check that bypasses the
database-access short-circuit.
([CWE-863](https://cwe.mitre.org/data/definitions/863.html))
</div>
</div>
<small><i>Code Review Run #4069da</i></small>
</div>
---
Should Bito avoid suggestions like this for future reviews? (<a
href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
- [ ] Yes, avoid them
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
