sha174n commented on code in PR #45452:
URL: https://github.com/apache/superset/pull/45452#discussion_r4329169739
##########
superset/security/manager.py:
##########
@@ -6165,6 +6167,7 @@ def get_guest_user_from_request(self, req: Request) ->
Optional[GuestUser]:
token = self.parse_jwt_guest_token(raw_token)
if token.get("user") is None:
raise ValueError("Guest token does not contain a user claim")
+ validate_guest_token_identity(token["user"])
Review Comment:
Added consume-side tests in b17ea27c16 (overlong and trailing-newline
usernames through get_guest_user_from_request return None; removing this line
fails them) and an UPDATING.md note under Next.
##########
superset/security/manager.py:
##########
@@ -6109,6 +6110,7 @@ def create_guest_access_token(
rls: list[GuestTokenRlsRule],
datasets: Optional[list[int]] = None,
) -> bytes:
+ validate_guest_token_identity(user)
Review Comment:
In b17ea27c16 the validator raises a dedicated GuestTokenIdentityError (a
ValueError subclass) and the endpoint maps it to a 400; covered by a test where
GUEST_TOKEN_VALIDATOR_HOOK alters the username after schema validation.
##########
superset/security/guest_token.py:
##########
@@ -138,6 +139,44 @@ class GuestTokenUser(TypedDict, total=False):
attributes: Optional[dict[str, Any]]
+# Upper bound for the identity strings carried in a guest token's ``user``
+# claim, a generous bound for a display identity.
+GUEST_TOKEN_IDENTITY_MAX_LENGTH = 255
+GUEST_TOKEN_IDENTITY_FIELDS = ("username", "first_name", "last_name")
Review Comment:
attributes is deliberately out of scope: it is free-form host-defined data,
not a display string. And yes, the driver is log lines, cache keys and request
context rather than templating; the docstring is corrected to say so in
b17ea27c16.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
