bito-code-review[bot] commented on code in PR #44036:
URL: https://github.com/apache/superset/pull/44036#discussion_r4055653020
##########
superset/commands/database/utils.py:
##########
@@ -135,6 +135,53 @@ def ssh_tunnel_rebind_unsafe(
return not has_fresh_credential or stale_private_key_password
+OAUTH2_ENDPOINT_FIELDS = (
+ "authorization_request_uri",
+ "token_request_uri",
+ "redirect_uri",
Review Comment:
<div>
<div id="suggestion">
<div id="issue"><b>Over-broad endpoint rebind check</b></div>
<div id="fix">
`redirect_uri` is not a destination that receives the client secret: in
`BaseEngineSpec.get_oauth2_token` the secret is posted only to
`token_request_uri` (base.py:995,1000); `redirect_uri` is just a body param
(base.py:1001). Treating a `redirect_uri` change as an unsafe rebind wrongly
rejects a legitimate update (e.g. instance domain change) that echoes the
masked secret. Consider limiting the check to `token_request_uri`.
</div>
</div>
<small><i>Code Review Run #1bb6d0</i></small>
</div>
---
Should Bito avoid suggestions like this for future reviews? (<a
href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
- [ ] Yes, avoid them
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
