aminghadersohi opened a new pull request, #45816: URL: https://github.com/apache/superset/pull/45816
### SUMMARY The SQL Lab query branch of `SecurityManager.raise_for_access` authorizes on the tables a query touches and returns before any embedded guest-token check runs. When the guest role can read those tables, an embedded guest could read a stored SQL Lab query (its rows, and its SQL) through `POST /api/v1/chart/data` with a `query` datasource, including a query run by another user, whatever dashboards or `datasets` the token authorizes. The default guest role, which has no table access, was already refused. `SECURITY.md` grants an embedded guest token only the data sources reachable through the embedded dashboards it authorizes, and no SQL execution. This change holds the query branch to that: - A guest reaches a `query` datasource only as the datasource of a chart, requested with its saved payload, on an embedded dashboard the token authorizes (`has_guest_access`). The usual table-level checks still apply on top. - A token carrying a `datasets` allowlist reaches no query datasource, matching the existing allowlist check, which only names SQL datasets. - A guest is refused ad hoc SQL (`raise_for_access(database=..., sql=...)`). - Query-backed chart data passes its query context to `raise_for_access` so the dashboard binding can be checked. - Non-guest behaviour is unchanged, including the SQL Lab author bypass. Out-of-scope requests raise `SupersetSecurityException` in the command's `validate` step, before any SQL runs, so the chart-data API answers 403 with no rows and no SQL. Other entry points that accept a datasource type and id from a guest all reach the same branch and are covered by the same check: chart data (POST and GET by chart id), samples and drill to detail (both via the query context processor), the datasource column-values API and `/fetch_datasource_metadata` (`Query.raise_for_access`), Explore GET and the explore form-data step (`raise_for_access(query=...)`), and SQL Lab results and CSV export (`Query.raise_for_access`). The legacy `/explore/` view only resolves table datasources, so it is not affected. ### TESTING INSTRUCTIONS `pytest tests/unit_tests/security/test_guest_query_datasource_scope.py` The guest cases (scoped token, unscoped token, the guest's own query, another user's query, an unbound chart-data request, ad hoc SQL, and a bound request with a `datasets` claim, a modified payload, an unauthorized dashboard or a chart on another datasource) fail on master and pass here. Positive controls: a query-backed chart on an authorized embedded dashboard is still readable, a bound request still needs table access, and a non-guest user's query access and author bypass are unchanged. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [x] Required feature flags: `EMBEDDED_SUPERSET` - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
