mikebridge commented on PR #44021: URL: https://github.com/apache/superset/pull/44021#issuecomment-5591425501
@aminghadersohi — requesting review on the sc-120001 authz fix, squarely in your versioning lane: QA found that view-only users could pull an entity's complete version history (authors, timestamps, field-level diffs) via `GET …/versions/` and `/activity/` while the UI hid the affordance. The policy call (per the governing SIP) is **edit-gated**: the read-posture wording in AV-008 is superseded (spec updated). The change is one choke point: `resolve_endpoint_path_entity` — shared by all six endpoint bodies (chart/dashboard/dataset × list/get-one/activity) — now enforces **object-level editorship** (`raise_for_editorship`, the same gate restore uses and the UI's `dash_edit_perm` mirrors; deliberately not model-level `can_write`, so a write-capable role can't read history of entities it doesn't own). Two hardenings from the independent review rounds this PR already went through (craft lenses + a cross-model Codex committer/security/python pass): - **Explicit guest deny before editorship** — the rounds' unanimous blocker: `is_editor` maps a guest's ROLE subjects into the editor set, so a role subject granted editorship would have admitted every embedded guest holding that role. Guests are now refused outright at the choke point (SECURITY.md's guest row places change logs outside the guest capability). Pinned at unit level (neither gate may even be consulted for a guest) and by an HTTP regression where the guest role's subject IS a dashboard editor. - **Identity-compared, first-ordered allowlist** — `_version_endpoint_models()` compares class identities (a class merely *named* `Slice` can't slip through) and runs before any parsing or DB work, so unwired models fail closed as the deliberate `LookupError`. Evidence: unit pins (editorship consulted, read gate never; refusal→403; guest short-circuit; fail-closed with DAO-not-called), a six-way HTTP non-editor deny matrix (chart/dashboard/dataset × list/get-one — get-one proves the gate precedes version resolution), a per-object Gamma-editor 200 (object-level, not model-level), and the three former read-posture tests flipped with the policy cited. AV-008's related-entity silent filter is untouched (TC-057 behavior preserved). UPDATING.md documents the breaking change, including that guests are always refused. One env note: this machine's integration fixtures are broken independently of the change (admin PUTs 404 at base too), so the integration matrix is CI-verified. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
