alexandrusoare commented on code in PR #45266:
URL: https://github.com/apache/superset/pull/45266#discussion_r4272119433
##########
superset/security/manager.py:
##########
@@ -5363,10 +5363,24 @@ def raise_for_access( # noqa: C901
catalog=effective_catalog,
)
for datasource_ in datasources:
+ # ``datasource_access`` on a registered dataset is always
+ # sufficient. Editorship of the dataset is accepted only on
+ # the non-strict path (chart-data, dataset CRUD,
+ # ``/table_metadata/``, ``/select_star/``), where it is the
+ # dataset-owner "explore your own dataset" grant from
+ # #20382. Under strict scoping (SQL Lab raw queries,
MetaDB,
Review Comment:
Editorship still returns raw rows on the non-strict path (`is_editor` at
manager.py:5433 → chart-data `query_mode: raw`, datasource samples) — does this
close the survives-revocation hole or just move it off SQL Lab?
##########
UPDATING.md:
##########
@@ -24,6 +24,21 @@ assists people when migrating to a new version.
## Next
+- Dataset editorship no longer authorizes raw SQL on the underlying table.
+ Under the strict dataset-match scoping used by SQL Lab raw queries, MetaDB,
Review Comment:
Alerts/reports also run through the strict path
(`commands/report/alert.py:260`, `commands/report/base.py:118`) — worth listing
alongside SQL Lab/MetaDB/MCP here.
##########
superset/security/manager.py:
##########
@@ -5363,10 +5363,24 @@ def raise_for_access( # noqa: C901
catalog=effective_catalog,
)
for datasource_ in datasources:
+ # ``datasource_access`` on a registered dataset is always
+ # sufficient. Editorship of the dataset is accepted only on
+ # the non-strict path (chart-data, dataset CRUD,
+ # ``/table_metadata/``, ``/select_star/``), where it is the
+ # dataset-owner "explore your own dataset" grant from
+ # #20382. Under strict scoping (SQL Lab raw queries,
MetaDB,
+ # MCP ``execute_sql``) editorship is deliberately excluded:
+ # returning raw rows from the underlying warehouse table
+ # must follow the user's live data-access grants, not
+ # editorship of a same-named dataset. Any principal able to
+ # create a dataset can make themselves an editor of one
+ # named after an arbitrary table, so accepting editorship
+ # here would let dataset creation stand in for data access
+ # and would outlive revocation of every real grant.
if self.can_access(
"datasource_access",
datasource_.perm or "",
- ) or self.is_editor(datasource_):
+ ) or (not force_dataset_match and
self.is_editor(datasource_)):
Review Comment:
The `force_dataset_match` docstring (line 4992) and
`extensions/metadb.py:382` both still say `datasource_access` "(or owns)".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
