aminghadersohi commented on code in PR #44033: URL: https://github.com/apache/superset/pull/44033#discussion_r3991705941
########## SECURITY.md: ########## @@ -94,6 +94,10 @@ Realtime transports, including WebSocket delivery backed by Redis or Valkey Pub/ The realtime notification permission is distinct from the permission to read the underlying object. It controls whether a principal receives push notifications, not whether they may read the object once they call the protected REST API. Existing websocket connections are authorized by the JWT accepted at upgrade time; permission revocation after token minting is bounded by `WEBSOCKET_JWT_EXPIRATION_SECONDS` plus the websocket server's socket-check interval. Redis Streams are internal server-to-server coordination primitives and should not be directly exposed as an end-user subscription surface. +### Version History and Change Metadata + +An entity's version history — its change-record activity stream, field-level before/after diffs, and the author identity and timestamps attached to each change — is not part of the base *Read data* capability. Reading it requires **object-level editorship** of the entity (owner, editor, or Admin), the same capability required to restore a version. A principal who can read an entity's current state but is not an editor of it — including an **embedded guest token** and any **view-only** (read-but-not-edit) role — is not entitled to its version history, change metadata, or author identity, and such requests are refused. Related-entity records in a cross-entity activity view remain silently filtered to the reader's own read access. A bug that discloses version history, change-record diffs, or author identity to a principal lacking object-level editorship is in scope. Review Comment: The guest clause isn't enforced by entitlement: `raise_for_access` returns early on `has_guest_access` before any editor check (`security/manager.py:4927-4931`). A guest is stopped only if `GUEST_ROLE_NAME`'s role lacks the route perms — true for stock `Public`, false for `Gamma`. ########## SECURITY.md: ########## @@ -94,6 +94,10 @@ Realtime transports, including WebSocket delivery backed by Redis or Valkey Pub/ The realtime notification permission is distinct from the permission to read the underlying object. It controls whether a principal receives push notifications, not whether they may read the object once they call the protected REST API. Existing websocket connections are authorized by the JWT accepted at upgrade time; permission revocation after token minting is bounded by `WEBSOCKET_JWT_EXPIRATION_SECONDS` plus the websocket server's socket-check interval. Redis Streams are internal server-to-server coordination primitives and should not be directly exposed as an end-user subscription surface. +### Version History and Change Metadata + +An entity's version history — its change-record activity stream, field-level before/after diffs, and the author identity and timestamps attached to each change — is not part of the base *Read data* capability. Reading it requires **object-level editorship** of the entity (owner, editor, or Admin), the same capability required to restore a version. A principal who can read an entity's current state but is not an editor of it — including an **embedded guest token** and any **view-only** (read-but-not-edit) role — is not entitled to its version history, change metadata, or author identity, and such requests are refused. Related-entity records in a cross-entity activity view remain silently filtered to the reader's own read access. A bug that discloses version history, change-record diffs, or author identity to a principal lacking object-level editorship is in scope. Review Comment: The read path gates on `raise_for_access` (`superset/versioning/api_helpers.py:297`), not editorship — `raise_for_editorship` appears nowhere under `superset/versioning/` at master; only restore uses it (`commands/version_restore.py:150`). Narrowing to what is enforced: ```suggestion An entity's version history — its change-record activity stream, field-level before/after diffs, and the author identity and timestamps attached to each change — is served under the entity's base *Read data* capability: the `/versions/` and `/activity/` endpoints apply the same per-object read gate as reading the entity itself. **Object-level editorship** (owner, editor, or Admin) is required to *restore* a version, not to read history. Related-entity records in a cross-entity activity view remain silently filtered to the reader's own read access. A bug that discloses version history, change-record diffs, or author identity to a principal who cannot read the entity itself is in scope. ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
