aminghadersohi commented on code in PR #45681:
URL: https://github.com/apache/superset/pull/45681#discussion_r4378411975
##########
superset/models/helpers.py:
##########
@@ -4015,7 +4015,9 @@ def get_from_clause(
# Apply RLS filters to virtual dataset SQL to prevent RLS bypass
# For each table referenced in the virtual dataset, apply its RLS
filters
if parsed_script.statements:
- default_schema = self.database.get_default_schema(self.catalog)
+ default_schema = self.schema or self.database.get_default_schema(
Review Comment:
I reproduced this on SQLite with
`test_virtual_dataset_rls_uses_connection_schema`: an unqualified query with a
different dataset schema returned `[1, 2]` instead of the RLS-filtered `[1]`,
for both SqlaTable and Query.
Fixed in ef1127d0c33ead3fbea76c7c5292de45fbe6b699. `_get_rls_schema()`
trusts the datasource schema only on dynamic-schema engines. Other engines use
`resolve_query_default_schema()`, including URI/connect-argument schema
resolution and the inspector fallback. The resolved value is used directly for
both injection and the fail-closed retry.
`test_virtual_dataset_rls_retry_uses_connection_schema` also changed from
continuing after injection failure to raising `QueryObjectValidationError`.
The sibling denylist schema resolver had the same assumption;
`test_virtual_dataset_denylist_uses_connection_schema` covers its correction.
The regression module changed from 8 failed / 44 passed to 52 passed. The
connection-count test still measures 0 connections on a hit and 1 on a miss for
dynamic-schema or statically known connection-schema cases.
Siblings checked:
- superset/models/helpers.py — fixed in
ef1127d0c33ead3fbea76c7c5292de45fbe6b699
- superset/connectors/sqla/models.py — fixed in
ef1127d0c33ead3fbea76c7c5292de45fbe6b699
- superset/models/sql_lab.py — fixed in
ef1127d0c33ead3fbea76c7c5292de45fbe6b699
- superset/utils/rls.py — not affected: it consumes qualified table names
and retains the required null-schema matching fallback.
- superset/security/manager.py — not affected: SQL Lab authorization already
uses the query-aware resolver and schema-permission enumeration uses stored
physical table schemas.
- superset/db_engine_specs/oceanbase.py — not affected: its reflection
fallback qualifies the metadata SQL with the supplied schema.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
