codeant-ai-for-open-source[bot] commented on code in PR #45214:
URL: https://github.com/apache/superset/pull/45214#discussion_r4248575092
##########
superset/commands/security/update.py:
##########
@@ -69,6 +69,11 @@ def validate(self) -> None:
# Datasource access is validated before revealing whether the
# requested name is already in use, so an unauthorized caller can't
# use the duplicate-name response to enumerate rule names.
+ # Any update mutates the rule, including one that rebinds it to other
+ # tables, which lifts the filter from the tables it leaves. The caller
+ # must therefore access the rule's current tables, and the new ones
+ # when ``tables`` is present.
+ raise_for_datasource_access(self._model.tables)
Review Comment:
✅ **Customized review instruction saved!**
**Instruction:**
> Do not flag the existing check-then-write race in this update command as a
new regression; recommend locking only when it can be addressed consistently
across commands and supported backends.
**Applied to:**
- `superset/commands/security/update.py`
---
💡 *To manage or update this instruction, visit: [CodeAnt AI
Settings](https://app.codeant.ai/org/settings/learnings)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
