You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "geo-chen (via GitHub)" <gi...@apache.org> on 2026/07/08 00:17:21 UTC
[I] [security hardening] SQL injection in PrestoBaseEngineSpec.latest_sub_partition via broken field guard [superset]
geo-chen opened a new issue, #41869:
URL: https://github.com/apache/superset/issues/41869
### Bug description
## Timeline
- 15 June 2026 - reported via email
- 8 July 2026 - Superset security team requested this be opened as a public issue for hardening
- 8 July 2026 - issue created
I am reporting an SQL injection vulnerability in the Jinja template function `latest_sub_partition` available to Presto and Trino database connections in SQL Lab.
**Affected versions**: 6.1.0 (confirmed); all versions with Presto/Trino support.
**Root cause**: `PrestoBaseEngineSpec.latest_sub_partition` in `superset/db_engine_specs/presto.py` contains a broken validation guard at line 666:
```python
for k in kwargs.keys():
if k not in k in part_fields: # pylint: disable=comparison-with-itself
raise SupersetTemplateException(...)
```
Python evaluates `k not in k in part_fields` as `(k not in k) and (k in part_fields)`. The sub-expression `k not in k` is always `False` for any string (a string is always a substring of itself), so the combined expression is always `False` and the raise is unreachable. The pylint disable comment confirms the linter flagged this; the warning was suppressed rather than fixed.
Caller-supplied kwargs then flow into `_partition_query` (lines 500-501) where both the field name and value are interpolated into SQL without escaping:
```python
l.append(f"{field} = '{value}'")
```
This generates a WHERE clause passed to `database.get_df(sql)` and executed against Presto or Trino.
**Entry point**: The function is exposed as `presto.latest_sub_partition` / `trino.latest_sub_partition` in the Jinja context for SQL Lab queries when `ENABLE_TEMPLATE_PROCESSING=True` is set on the database connection.
**Impact**: When template processing is enabled on a Presto/Trino database, any authenticated SQL Lab user can inject SQL into the partition metadata query via:
```sql
SELECT '{{ presto.latest_sub_partition("schema.table", partition_col="val'' UNION SELECT secret FROM other_table--") }}'
```
The injected query runs with the database connection's service account credentials, which on Hive/Iceberg deployments commonly has read access across all schemas. This bypasses Superset row-level security and schema-access controls for the affected database.
**PoC (real-fn-in-process, no live Presto required)**:
```python
# Verbatim guard from line 666 - always False
part_fields = ["ds", "event_type"]
k = "event_type"
print(k not in k in part_fields) # False -- guard never fires
# Injection sink from lines 500-501
filters = {"event_type": "click' UNION SELECT secret FROM vault--"}
l = []
for field, value in filters.items():
l.append(f"{field} = '{value}'")
where_clause = "WHERE " + " AND ".join(l)
print(where_clause)
# Output: WHERE event_type = 'click' UNION SELECT secret FROM vault--'
```
**Suggested fix**:
1. Line 666: change `if k not in k in part_fields:` to `if k not in part_fields:`
2. Lines 500-501: parameterize the query rather than using f-string interpolation for filter values.
Both `PrestoEngineSpec` and `TrinoEngineSpec` inherit from `PrestoBaseEngineSpec` and are affected.
### Screenshots/recordings
_No response_
### Superset version
6.1.0
### Python version
3.9
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] [security hardening] SQL injection in PrestoBaseEngineSpec.latest_sub_partition via broken field guard [superset]
Posted by "cschanhniem (via GitHub)" <gi...@apache.org>.
cschanhniem commented on issue #41869:
URL: https://github.com/apache/superset/issues/41869#issuecomment-4917292948
The SQL injection surface here is in the Presto `latest_sub_partition` implementation, where the partition field from the form data is embedded into a SQL string. The current guard blocks some patterns but a regex-based allowlist is inherently fragile — Presto partition names can contain arbitrary identifiers including dotted paths and reserved words.
A more robust fix would be to parameterize the partition field through the SQLAlchemy text() construct with bind parameters, or to validate the field against the actual list of known partitions (retrieved via SHOW PARTITIONS) before constructing the query, rather than trying to sanitize the input string.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] [security hardening] SQL injection in PrestoBaseEngineSpec.latest_sub_partition via broken field guard [superset]
Posted by "mysticalayushi (via GitHub)" <gi...@apache.org>.
mysticalayushi commented on issue #41869:
URL: https://github.com/apache/superset/issues/41869#issuecomment-4913786019
Hi @Abdulrehman-PIAIC80387, thanks for checking in! I haven't started implementing the fix yet. Since you already have a working solution with regression tests, please feel free to open the PR. I appreciate you reaching out to avoid duplicate work. Best of luck with the contribution!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] [security hardening] SQL injection in PrestoBaseEngineSpec.latest_sub_partition via broken field guard [superset]
Posted by "mysticalayushi (via GitHub)" <gi...@apache.org>.
mysticalayushi commented on issue #41869:
URL: https://github.com/apache/superset/issues/41869#issuecomment-4911460707
Hi! I'd like to work on this issue if it's still available. If no one is currently working on it, I'll start investigating and prepare a fix. Please let me know if there are any implementation details or considerations I should be aware of. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] [security hardening] SQL injection in PrestoBaseEngineSpec.latest_sub_partition via broken field guard [superset]
Posted by "Abdulrehman-PIAIC80387 (via GitHub)" <gi...@apache.org>.
Abdulrehman-PIAIC80387 commented on issue #41869:
URL: https://github.com/apache/superset/issues/41869#issuecomment-4913555362
Hi @mysticalayushi — noticed you asked about this issue earlier today. Are you actively working on a PR, or is it still open? I have a fix ready locally (guard bypass + value escaping in `_partition_query`, with regression tests) and am happy to open the PR if you haven't started yet. Just want to avoid duplicating your work — please let me know either way. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] [security hardening] SQL injection in PrestoBaseEngineSpec.latest_sub_partition via broken field guard [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #41869: [security hardening] SQL injection in PrestoBaseEngineSpec.latest_sub_partition via broken field guard
URL: https://github.com/apache/superset/issues/41869
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org