verdier commented on code in PR #45214:
URL: https://github.com/apache/superset/pull/45214#discussion_r4248569337
##########
superset/commands/security/update.py:
##########
@@ -69,6 +69,11 @@ def validate(self) -> None:
# Datasource access is validated before revealing whether the
# requested name is already in use, so an unauthorized caller can't
# use the duplicate-name response to enumerate rule names.
+ # Any update mutates the rule, including one that rebinds it to other
+ # tables, which lifts the filter from the tables it leaves. The caller
+ # must therefore access the rule's current tables, and the new ones
+ # when ``tables`` is present.
+ raise_for_datasource_access(self._model.tables)
Review Comment:
This check-then-write window exists in every Superset command (RLS
create/delete and the partial-update branch from #41294 included); none of them
lock. Exploiting it needs a privileged user to rebind the rule within the same
few milliseconds, which the caller cannot trigger. Locking only here would make
this command the odd one out, and it does nothing on SQLite. This PR closes the
deterministic rebind bypass and opens nothing new, so I'd keep it focused.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
