mikebridge opened a new pull request, #44021:
URL: https://github.com/apache/superset/pull/44021
### SUMMARY
Fixes SC-120001 (High, information disclosure): a user with read/view access
but **no edit rights and no ownership** could retrieve an entity's complete
version history — author identities, timestamps, and field-level before/after
diffs — via `GET /api/v1/{chart,dashboard}/<uuid>/versions/` and `/activity/`,
even though the UI correctly hides the Version history affordance for them. The
endpoints enforced the object **read** gate (SC-107283 AV-008's posture); the
governing SIP decision now supersedes that: **version history is edit-gated**.
The change is one choke point: `resolve_endpoint_path_entity`
(`superset/versioning/api_helpers.py`), shared by all six endpoint bodies
(chart/dashboard/dataset × versions list / get-one / activity), now enforces
**object-level editorship** (`security_manager.raise_for_editorship` —
owner/editor/admin), the same gate the restore command uses and the same
condition the UI's `dash_edit_perm` mirrors. Deliberately object-level rather
than model-level `can_write`, so a write-capable role cannot read the history
of entities it does not own. The kwarg dispatch table becomes an explicit
fail-closed allowlist (`_VERSION_ENDPOINT_MODELS`). **Related-entity visibility
filtering inside the activity stream (AV-008's silent filter, QA TC-057) is
unchanged.**
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — API authorization change. Before: view-only user → 200 + full history
(QA TC-062/064/066). After: 403; editors/owners/admins unchanged.
### TESTING INSTRUCTIONS
```bash
python -m pytest tests/unit_tests/versioning -q # 148 passed
python -m pytest tests/integration_tests/versioning/versions_api_tests.py \
tests/integration_tests/versioning/activity_view_tests.py
```
- **Unit pins** (`test_endpoint_gate.py`): the choke point consults
`raise_for_editorship` and never `raise_for_access`; refusal maps to 403;
unwired models fail closed.
- **Integration role matrix** (sc-120001 pins): Alpha — read-capable
non-editor, the exact leaking principal — now 403s on both chart and dashboard
`/versions/`; a per-object Gamma **editor** gets 200 (object-level, not
model-level); a guest-token principal is refused by the gate (M10). The three
former read-posture tests flip to editorship expectations.
- Reverted-gate control: restoring the read gate fails the not-called unit
pin and the Alpha-403 pins.
- Note: this machine's integration env has a pre-existing fixture breakage
(admin PUTs 404 — identical failure set with the fix stashed), so the
integration matrix is CI-verified rather than locally.
### ADDITIONAL INFORMATION
- [x] Has associated issue: SC-120001 (decision per the SC-103156 SIP;
supersedes SC-107283 AV-008's read wording — spec updated)
- [x] Required feature flags: `VERSION_HISTORY` /
`ENABLE_VERSIONING_CAPTURE` (the gated endpoints)
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Introduces new feature or API
- [x] Removes existing feature or API (read-only principals lose API access
to version history — see UPDATING.md)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01JRLEJS4mUqKBoPjSjviKUW
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
