bito-code-review[bot] commented on code in PR #43998:
URL: https://github.com/apache/superset/pull/43998#discussion_r3960607698
##########
superset/mcp_service/sql_lab/tool/execute_sql.py:
##########
@@ -171,6 +175,29 @@ async def execute_sql(request: ExecuteSqlRequest, ctx:
Context) -> ExecuteSqlRes
error_type=SupersetErrorType.DATABASE_SECURITY_ACCESS_ERROR.value,
)
+ # 1b. Enforce dataset/table-level access, matching the SQL Lab
+ # execution path (which calls raise_for_access(...,
force_dataset_match=
+ # True)). Access to the database connection alone does not authorize
+ # every table on it: the query must resolve to datasets the user is
+ # granted, so the tables it references are validated here before it
runs.
+ with
event_logger.log_context(action="mcp.execute_sql.table_access_validation"):
+ try:
+ security_manager.raise_for_access(
+ database=database,
+ sql=request.sql,
+ catalog=request.catalog,
+ schema=request.schema_name,
+ template_params=request.template_params,
+ force_dataset_match=True,
+ )
Review Comment:
<!-- Bito Reply -->
The suggestion is correct. The previous implementation was indeed
short-circuited by the database-level access check, rendering the table-level
validation ineffective. Removing the gate and relying on `raise_for_access`
with `force_dataset_match=True` correctly ensures that table-level access is
enforced for the specific tables resolved by the query.
**superset/mcp_service/sql_lab/tool/execute_sql.py**
```
with
event_logger.log_context(action="mcp.execute_sql.table_access_validation"):
try:
security_manager.raise_for_access(
database=database,
sql=request.sql,
catalog=request.catalog,
schema=request.schema_name,
template_params=request.template_params,
force_dataset_match=True,
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
