geido commented on code in PR #45266:
URL: https://github.com/apache/superset/pull/45266#discussion_r4275208200
##########
tests/integration_tests/security_tests.py:
##########
@@ -1928,6 +1928,63 @@ def
test_raise_for_access_force_dataset_match_denies_schema_only(
with self.assertRaises(SupersetSecurityException): # noqa: PT027
security_manager.raise_for_access(query=query,
force_dataset_match=True)
+
@patch("superset.connectors.sqla.models.SqlaTable.query_datasources_by_name")
+ @patch("superset.security.SupersetSecurityManager.is_editor")
+ @patch("superset.security.SupersetSecurityManager.can_access")
+ def test_raise_for_access_force_dataset_match_denies_editor_only(
+ self, mock_can_access, mock_is_editor, mock_query_datasources
+ ):
+ """
+ Regression test (SC-126545): with force_dataset_match=True, being an
Review Comment:
Removed in 3cb4a8f.
##########
tests/unit_tests/security/manager_test.py:
##########
@@ -4120,6 +4120,50 @@ def
test_raise_for_access_catalog_self_reference_does_not_weaken_sqllab_strict_m
sm.raise_for_access(query=query, force_dataset_match=True)
+def test_raise_for_access_editorship_denied_in_strict_mode(
+ mocker: MockerFixture,
+ app_context: None,
+) -> None:
+ """
+ SC-126545: editorship of a registered dataset for the referenced table
Review Comment:
Removed here too (3cb4a8f).
##########
UPDATING.md:
##########
@@ -24,6 +24,22 @@ assists people when migrating to a new version.
## Next
+- Dataset editorship no longer authorizes raw SQL on the underlying table.
+ Under the strict dataset-match scoping used by SQL Lab raw queries, MetaDB,
+ the MCP `execute_sql` tool, and alert/report query execution
+ (`raise_for_access(force_dataset_match=True)`,
+ introduced in #40409), access to a referenced table now requires
+ `datasource_access` on a registered dataset for that table — being an
+ *editor* (owner) of such a dataset is no longer sufficient. A principal who
+ can create datasets could previously make themselves an editor of a dataset
+ named after any table and thereby run raw SQL on it, and that access
+ outlived revocation of every real database/catalog/schema/datasource grant.
+ The dataset-owner "explore your own dataset" grant (#20382) is unchanged for
+ chart-data, dataset CRUD, `/table_metadata/`, and `/select_star/`; only the
+ raw-row strict path is affected. If you relied on dataset editorship alone to
+ run SQL Lab or MCP queries against a table, grant the role explicit
+ `datasource_access` on the dataset instead.
Review Comment:
Makes sense — dropped the note in 3cb4a8f; we can add it when this ships
with the release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
