gabotorresruiz commented on PR #44033: URL: https://github.com/apache/superset/pull/44033#issuecomment-5688570236
Follow-up on the merged text. The sequencing worked out (this landed after #44021, so the present tense guarantees are enforced), but one part of the paragraph now on master worries me: the closing in-scope sentence classifies designed behavior as a vulnerability. Given editorship of dashboard `D`, the cross-entity activity view returns related chart and dataset records gated by the reader's read access to the related entity, and live related records carry `changed_by`, `from_value`, `to_value`, and `path` in full (`superset/versioning/activity/render.py`; redaction applies only to deleted related entities, and #44021 deliberately left that filter unchanged). So a principal lacking editorship of chart `C` legitimately receives `C`'s diffs and author identity through `D`'s activity view, which `A bug that discloses ... to a principal lacking object-level editorship is in scope` would classify as reportable. Suggest a small follow-up PR scoping the entitlement rule to the entity's own endpoints and making the related-record behavior an explicit exception, plus stating the stronger guest guarantee #44021 actually enforces (guests are refused categorically, ahead of the editor check, even when a role subject they carry holds editorship). Happy to open it if you prefer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
