bito-code-review[bot] commented on code in PR #43998:
URL: https://github.com/apache/superset/pull/43998#discussion_r3959156049
##########
superset/mcp_service/sql_lab/tool/execute_sql.py:
##########
@@ -171,6 +175,29 @@ async def execute_sql(request: ExecuteSqlRequest, ctx:
Context) -> ExecuteSqlRes
error_type=SupersetErrorType.DATABASE_SECURITY_ACCESS_ERROR.value,
)
+ # 1b. Enforce dataset/table-level access, matching the SQL Lab
+ # execution path (which calls raise_for_access(...,
force_dataset_match=
+ # True)). Access to the database connection alone does not authorize
+ # every table on it: the query must resolve to datasets the user is
+ # granted, so the tables it references are validated here before it
runs.
+ with
event_logger.log_context(action="mcp.execute_sql.table_access_validation"):
+ try:
+ security_manager.raise_for_access(
+ database=database,
+ sql=request.sql,
+ catalog=request.catalog,
+ schema=request.schema_name,
+ template_params=request.template_params,
+ force_dataset_match=True,
+ )
Review Comment:
<!-- Bito Reply -->
The observation that the database-level gate short-circuits the check is
correct. Since the current implementation relies on `raise_for_access` which
returns early when database access is already granted, the
`force_dataset_match=True` parameter is indeed not enforced for individual
tables. Keeping the thread open is appropriate while the approach is being
reworked to ensure table-level validation is correctly applied.
**superset/mcp_service/sql_lab/tool/execute_sql.py**
```
security_manager.raise_for_access(
database=database,
sql=request.sql,
catalog=request.catalog,
schema=request.schema_name,
template_params=request.template_params,
force_dataset_match=True,
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
