You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "YuriyKrasilnikov (via GitHub)" <gi...@apache.org> on 2026/01/22 10:01:31 UTC

[I] fix: Double RLS application in virtual datasets for guest users (regression from PR #36061) [superset]

YuriyKrasilnikov opened a new issue, #37359:
URL: https://github.com/apache/superset/issues/37359

   ### Bug description
   
   **Summary:**
   PR #36061 "fix: RLS in virtual datasets" introduced a regression causing **double RLS application** for guest users with embedded dashboards. This is similar to #34894 (double time filter application) fixed in PR #35890.
   
   **Steps to Reproduce:**
   1. Create a physical dataset for table `my_table`
   2. Create a virtual dataset with SQL referencing that table:
      ```sql
      SELECT * FROM my_schema.my_table WHERE some_column = 'value'
      ```
   3. Create a dashboard with a chart using this virtual dataset
   4. Generate a guest token with RLS clause: `tenant_id = 123`
   5. Open the embedded dashboard with this guest token
   6. Observe SQL error with incorrect table alias
   
   **Expected behavior:**
   RLS should be applied once - either to the underlying table OR to the virtual dataset output.
   
   **Actual behavior:**
   RLS is applied twice:
   1. First by `apply_rls()` in `models/helpers.py:2047-2057` (wraps underlying table in subquery)
   2. Second by `get_sqla_row_level_filters()` in `models/helpers.py:3198` (adds WHERE clause to virtual dataset query)
   
   Generated SQL example:
   ```sql
   SELECT ... FROM (
     SELECT * FROM my_schema.my_table
     WHERE tenant_id = 123  -- First RLS applied to underlying table (correct)
   ) AS `my_schema.my_table`
   WHERE my_table.tenant_id = 123  -- Second RLS applied with WRONG alias!
   GROUP BY ...
   ```
   
   The second WHERE clause uses `my_table.tenant_id` but the subquery is aliased as `my_schema.my_table`, causing SQL errors like:
   ```
   Unknown expression or function identifier 'my_table.tenant_id'
   ```
   
   **Root Cause:**
   - `get_from_clause()` in `models/helpers.py:2047-2057` calls `apply_rls()` which wraps tables referenced in virtual dataset SQL with subqueries containing RLS predicates
   - `get_sqla_query()` in `models/helpers.py:3198` calls `get_sqla_row_level_filters()` which adds guest token RLS to the outer WHERE clause
   - For guest users with embedded dashboards, both mechanisms fire independently, causing double application with mismatched aliases
   
   **Related:**
   - PR #35890 fixed an identical pattern for time filters (double time filter application)
   - PR #36061 introduced this regression (merged 2025-11-14)
   
   ### Screenshots/recordings
   
   N/A - backend SQL generation issue
   
   ### Superset version
   
   6.0.0
   
   ### Python version
   
   3.11
   
   ### Node version
   
   18 or greater
   
   ### Browser
   
   Not applicable
   
   ### Additional context
   
   - Feature flags enabled: `EMBEDDED_SUPERSET`
   - This is a regression - worked correctly in Superset 5.x
   - No configuration workaround available
   - Workaround: use physical datasets instead of virtual datasets (not always possible)
   
   ### Checklist
   
   - [X] I have searched Superset docs and Slack and didn't find a solution to my problem.
   - [X] I have searched the GitHub issue tracker and didn't find a similar bug report.
   - [X] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] Double RLS application in virtual datasets for guest users (regression from PR #36061) [superset]

Posted by "YuriyKrasilnikov (via GitHub)" <gi...@apache.org>.
YuriyKrasilnikov commented on issue #37359:
URL: https://github.com/apache/superset/issues/37359#issuecomment-4036778700

   Fix submitted in #37395 — selective global guest RLS filtering prevents double application in virtual datasets while preserving dataset-scoped guest rules.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] Double RLS application in virtual datasets for guest users (regression from PR #36061) [superset]

Posted by "kgabryje (via GitHub)" <gi...@apache.org>.
kgabryje closed issue #37359: Double RLS application in virtual datasets for guest users (regression from PR #36061)
URL: https://github.com/apache/superset/issues/37359


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] Double RLS application in virtual datasets for guest users (regression from PR #36061) [superset]

Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #37359:
URL: https://github.com/apache/superset/issues/37359#issuecomment-3783553596

   <!-- Answer -->
   This regression happens because RLS is applied twice for guest users with embedded dashboards using virtual datasets: once by wrapping the underlying table in a subquery with RLS predicates (`apply_rls()`), and again by adding RLS filters to the outer query (`get_sqla_row_level_filters()`). This double application leads to SQL alias mismatches and errors, since the outer WHERE clause references an alias that doesn't exist after the subquery rewrite. The pattern is nearly identical to the previously fixed double time filter bug (PR #35890). There’s currently no config workaround except using physical datasets, which isn’t always practical. No open PR or issue addresses this regression yet, so a fix will likely require logic to prevent RLS from being applied twice in this scenario—potentially by detecting when RLS has already been pushed down into the subquery and skipping the outer filter application.  
   You can review the relevant code and logic in [models/helpers.py](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/helpers.py#L1073-L2117) and [superset/utils/rls.py](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/utils/rls.py#L32-L115).
   
   
   <!-- Dosu Comment Footer -->
   *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
   
   ---
   <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/42b04683-9982-406d-8809-74837d2c8fe0?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/42b04683-9982-406d-8809-74837d2c8fe0?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/42b04683-9982-406d-8809-74837d2c8fe0?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/42b04683-9982-406d-8809-74837d2c8fe0?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/42b04683-9982-406d-8809-74837d2c8fe0?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/42b04683-9982-406d-8809-74837d2c8fe0?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/42b04683-9982-406d-8809-74837d2c8fe0?feedback_type=other)</sup>
   
   [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20regression%20happens%20because%20RLS%20is%20applied%20twice%20for%20guest%20users%20with%20embedded%20dashboards%20using%20virtual%20datasets%3A%20once%20by%20wrapping%20the%20underlying%20table%20in%20a%20subquery%20with%20RLS%20predicates%20%28%60apply_rls%28%29%60%29%2C%20and%20again%20by%20adding%20RLS%20filters%20to%20the%20outer%20query%20%28%60get_sqla_row_level_filters%28%29%60%29.%20This%20double%20application%20leads%20to%20SQL%20alias%20mismatches%20and%20errors%2C%20since%20the%20outer%20WHERE%20clause%20references%20an%20alias%20that%20doesn%27t%20exist%20after%20the%20subquery%20rewrite.%20The%20pattern%20is%20nearly%20identical%20to%20the%20previously%20fixed%20double%20time%20filter%20bug%20%28PR%20%2335890%29.%20There%E2%80%
 99s%20currently%20no%20config%20workaround%20except%20using%20physical%20datasets%2C%20which%20isn%E2%80%99t%20always%20practical.%20No%20open%20PR%20or%20issue%20addresses%20this%20regression%20yet%2C%20so%20a%20fix%20will%20likely%20require%20logic%20to%20prevent%20RLS%20from%20being%20applied%20twice%20in%20this%20scenario%E2%80%94potentially%20by%20detecting%20when%20RLS%20has%20already%20been%20pushed%20down%20into%20the%20subquery%20and%20skipping%20the%20outer%20filter%20application.%20%20%0AYou%20can%20review%20the%20relevant%20code%20and%20logic%20in%20%5Bmodels/helpers.py%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/helpers.py%23L1073-L2117%29%20and%20%5Bsuperset/utils/rls.py%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/utils/rls.py%23L32-L115%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.
 dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/37359)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org