sha174n opened a new pull request, #45452: URL: https://github.com/apache/superset/pull/45452
### Summary A guest token's `user` claim carries `username` / `first_name` / `last_name`, supplied by the host application that mints the token. They were accepted verbatim, with no length bound and no check for control characters, and later surface in logging, request context, and templated query contexts. This adds `validate_guest_token_identity()` and applies it both when a token is minted (`create_guest_access_token`) and when one is consumed (`get_guest_user_from_request`). Identity fields must be bounded, single-line strings; control characters (e.g. an embedded newline) and overlong values are rejected, consistent with how other request-supplied strings are validated. Each field stays optional. ### Testing Instructions `pytest tests/unit_tests/security/test_guest_token_identity.py` (24 cases added). Existing guest-token and embedded unit tests pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
