msyavuz commented on code in PR #45266:
URL: https://github.com/apache/superset/pull/45266#discussion_r4273872246
##########
tests/integration_tests/security_tests.py:
##########
@@ -1928,6 +1928,63 @@ def
test_raise_for_access_force_dataset_match_denies_schema_only(
with self.assertRaises(SupersetSecurityException): # noqa: PT027
security_manager.raise_for_access(query=query,
force_dataset_match=True)
+
@patch("superset.connectors.sqla.models.SqlaTable.query_datasources_by_name")
+ @patch("superset.security.SupersetSecurityManager.is_editor")
+ @patch("superset.security.SupersetSecurityManager.can_access")
+ def test_raise_for_access_force_dataset_match_denies_editor_only(
+ self, mock_can_access, mock_is_editor, mock_query_datasources
+ ):
+ """
+ Regression test (SC-126545): with force_dataset_match=True, being an
Review Comment:
Can we remove the ref to sc here?
##########
tests/unit_tests/security/manager_test.py:
##########
@@ -4120,6 +4120,50 @@ def
test_raise_for_access_catalog_self_reference_does_not_weaken_sqllab_strict_m
sm.raise_for_access(query=query, force_dataset_match=True)
+def test_raise_for_access_editorship_denied_in_strict_mode(
+ mocker: MockerFixture,
+ app_context: None,
+) -> None:
+ """
+ SC-126545: editorship of a registered dataset for the referenced table
Review Comment:
Here as well
##########
UPDATING.md:
##########
@@ -24,6 +24,22 @@ assists people when migrating to a new version.
## Next
+- Dataset editorship no longer authorizes raw SQL on the underlying table.
+ Under the strict dataset-match scoping used by SQL Lab raw queries, MetaDB,
+ the MCP `execute_sql` tool, and alert/report query execution
+ (`raise_for_access(force_dataset_match=True)`,
+ introduced in #40409), access to a referenced table now requires
+ `datasource_access` on a registered dataset for that table — being an
+ *editor* (owner) of such a dataset is no longer sufficient. A principal who
+ can create datasets could previously make themselves an editor of a dataset
+ named after any table and thereby run raw SQL on it, and that access
+ outlived revocation of every real database/catalog/schema/datasource grant.
+ The dataset-owner "explore your own dataset" grant (#20382) is unchanged for
+ chart-data, dataset CRUD, `/table_metadata/`, and `/select_star/`; only the
+ raw-row strict path is affected. If you relied on dataset editorship alone to
+ run SQL Lab or MCP queries against a table, grant the role explicit
+ `datasource_access` on the dataset instead.
Review Comment:
This note should probably wait a bit since this ships with the release
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
