EnxDev opened a new issue, #45658: URL: https://github.com/apache/superset/issues/45658
Follow-up from #45342 ([thread](https://github.com/apache/superset/pull/45342#discussion_r4299376456)). ### Problem When a virtual dataset is saved, its SQL access check renders the template with the stored `template_params` only. Chart execution renders the same SQL with request-time context on top: `columns`, `groupby`, `metrics`, `filter`, `from_dttm`/`to_dttm`, `url_param()`, `filter_values()`, `current_username()` and so on. A template can branch on any of these, so the SQL that runs can read tables the save-time check never saw. At execution time `raise_for_access(datasource=...)` accepts an editor of the dataset through `is_editor` (#20382) without looking at the rendered SQL, so nothing catches the other branch. Example, with `ENABLE_TEMPLATE_PROCESSING` on and a role that has dataset write but no access to `public.customer_pii`: ```sql {% if columns is defined %} SELECT secret FROM public.customer_pii {% else %} SELECT 1 AS secret {% endif %} ``` Create (and column sync) renders the `else` branch and passes. Chart-data renders the first branch and is authorized by editorship. Update, import and `/datasource/save/` behave the same way. With `url_param()` the caller picks the branch on every request, so no save-time rendering can bound what execution renders. This is not introduced by #45342; master behaves the same. ### Proposed fix When a virtual dataset is authorized only by editorship, re-check the tables of the SQL that execution actually rendered, with `allow_dataset_editorship=False`. This changes runtime authorization for every virtual dataset an editor uses through #20382, so it needs to cover every execution path: chart-data, samples, drill to detail, exports and reports. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
