codeant-ai-for-open-source[bot] commented on code in PR #43848:
URL: https://github.com/apache/superset/pull/43848#discussion_r4020567255
##########
superset/charts/filters.py:
##########
@@ -150,16 +155,40 @@ def _apply_viewers(self, query: Query) -> Query:
filters.append(Slice.id.in_(viewer_query))
# (C) No-viewer fallback: charts with no viewers → dataset-based access
+ layer_grant_clause = semantic_layer_grant_clause()
chart_has_viewers = Slice.viewers.any()
table_alias = aliased(SqlaTable)
no_viewer_query = (
db.session.query(Slice.id)
- .join(table_alias, Slice.datasource_id == table_alias.id)
- .join(models.Database, table_alias.database_id ==
models.Database.id)
+ # Type-aware datasource joins (mirroring DashboardAccessFilter):
+ # the SqlaTable join is constrained to table-backed charts (an
+ # unconstrained id join can bind a semantic-view chart to an
+ # unrelated table sharing its numeric id) and kept outer so
+ # charts on other datasource types survive into the access
+ # filter — their access matches through the perm columns
+ # denormalized onto Slice by ``set_related_perm``. A chart whose
+ # datasource row is hard-deleted can still match its stale
+ # denormalized perm here; the object gate stays authoritative
+ # and denies (accepted edge, shared with the dashboard filter).
+ .join(table_alias, table_backed_slice_join(table_alias),
isouter=True)
+ .join(
+ models.Database,
+ table_alias.database_id == models.Database.id,
+ isouter=True,
Review Comment:
✅ **Customized review instruction saved!**
**Instruction:**
> Do not flag stale Slice.perm exposure after dataset deletion when the
deletion lifecycle removes the dataset's datasource_access PVM; focus security
findings on residual schema_perm/catalog_perm behavior and validate it with
lifecycle tests.
**Applied to:**
- `superset/charts/filters.py`
---
💡 *To manage or update this instruction, visit: [CodeAnt AI
Settings](https://app.codeant.ai/org/settings/learnings)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
