You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by GitBox <gi...@apache.org> on 2022/06/09 01:16:42 UTC
[GitHub] [superset] betodealmeida opened a new pull request, #20323: feat: safer insert RLS
betodealmeida opened a new pull request, #20323:
URL: https://github.com/apache/superset/pull/20323
<!---
Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/
Example:
fix(dashboard): load charts correctly
-->
### SUMMARY
<!--- Describe the change below, including rationale and design decisions -->
We currently have a feature flag `RLS_IN_SQLLAB` that, when enabled, applies any relevant RLS rules to the SQL executed in SQL Lab. The current approach parses the SQL and extracts all tables being queried. If any of those tables have RLS rules associated with them the parse tree is modified inplace, appending the RLS predicate to the associated `WHERE` clause or creating a new one if needed.
@mistercrunch suggested an approach that is more bulletproof: replacing the table reference (eg, `my_table`) with a subquery that contains the RLS (`SELECT * FROM my_table WHERE rls`). This can be done conditionally on databases that support subqueries. I implemented that solution in this PR.
Note that this method is probably still not bulletproof. We're still using `sqlparse` to find table references, and this has been error-prone in the past. For example, we had problems where the identifier "RAW" was not detected properly because `sqlparse` considers it a reserved keyword, since it doesn't have separate lists of keywords for each dialect.
This PR and the original method are both conservative in cases like these, trying to figure out if a keyword is actually and identifier, and the unit tests cover such cases. But we should consider this feature experimental, and warn users that there are risks associated with using it.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
<!--- Skip this if not applicable -->
N/A
### TESTING INSTRUCTIONS
<!--- Required! What steps can be taken to manually verify the changes? -->
Added unit tests.
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] betodealmeida commented on a diff in pull request #20323: feat: safer insert RLS
Posted by GitBox <gi...@apache.org>.
betodealmeida commented on code in PR #20323:
URL: https://github.com/apache/superset/pull/20323#discussion_r892989081
##########
superset/connectors/sqla/utils.py:
##########
@@ -174,7 +174,7 @@ def validate_adhoc_subquery(
level=ErrorLevel.ERROR,
)
)
- statement = insert_rls(statement, database_id, default_schema)
+ statement = insert_rls_in_predicate(statement, database_id, default_schema)
Review Comment:
The old `insert_rls` method was renamed to `insert_rls_in_predicate`. Here we still use the old method because this is only used in Explore, while the current PR is only concerned with SQL Lab.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] betodealmeida commented on pull request #20323: feat: safer insert RLS
Posted by "betodealmeida (via GitHub)" <gi...@apache.org>.
betodealmeida commented on PR #20323:
URL: https://github.com/apache/superset/pull/20323#issuecomment-1500586634
Ping @dpgaspar @villebro.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] betodealmeida commented on pull request #20323: feat: safer insert RLS
Posted by "betodealmeida (via GitHub)" <gi...@apache.org>.
betodealmeida commented on PR #20323:
URL: https://github.com/apache/superset/pull/20323#issuecomment-1439315097
Friendly ping @dpgaspar @villebro on this. :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] betodealmeida commented on a diff in pull request #20323: feat: safer insert RLS
Posted by GitBox <gi...@apache.org>.
betodealmeida commented on code in PR #20323:
URL: https://github.com/apache/superset/pull/20323#discussion_r892989081
##########
superset/connectors/sqla/utils.py:
##########
@@ -174,7 +174,7 @@ def validate_adhoc_subquery(
level=ErrorLevel.ERROR,
)
)
- statement = insert_rls(statement, database_id, default_schema)
+ statement = insert_rls_in_predicate(statement, database_id, default_schema)
Review Comment:
This is used in explore, the current PR changes only SQL Lab.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat: safer insert RLS [superset]
Posted by "betodealmeida (via GitHub)" <gi...@apache.org>.
betodealmeida merged PR #20323:
URL: https://github.com/apache/superset/pull/20323
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] codecov[bot] commented on pull request #20323: feat: safer insert RLS
Posted by GitBox <gi...@apache.org>.
codecov[bot] commented on PR #20323:
URL: https://github.com/apache/superset/pull/20323#issuecomment-1150597292
# [Codecov](https://codecov.io/gh/apache/superset/pull/20323?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#20323](https://codecov.io/gh/apache/superset/pull/20323?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (eab77ca) into [master](https://codecov.io/gh/apache/superset/commit/1e5cacda8f939874bc05832234f24579b7400c3a?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (1e5cacd) will **decrease** coverage by `12.07%`.
> The diff coverage is `96.00%`.
```diff
@@ Coverage Diff @@
## master #20323 +/- ##
===========================================
- Coverage 66.60% 54.53% -12.08%
===========================================
Files 1734 1734
Lines 65003 65023 +20
Branches 6872 6872
===========================================
- Hits 43297 35458 -7839
- Misses 19949 27808 +7859
Partials 1757 1757
```
| Flag | Coverage Δ | |
|---|---|---|
| hive | `?` | |
| mysql | `?` | |
| postgres | `?` | |
| presto | `53.53% <16.00%> (-0.04%)` | :arrow_down: |
| python | `57.75% <96.00%> (-25.03%)` | :arrow_down: |
| sqlite | `?` | |
| unit | `50.18% <96.00%> (+0.03%)` | :arrow_up: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#carryforward-flags-in-the-pull-request-comment) to find out more.
| [Impacted Files](https://codecov.io/gh/apache/superset/pull/20323?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) | Coverage Δ | |
|---|---|---|
| [superset/connectors/sqla/utils.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQvY29ubmVjdG9ycy9zcWxhL3V0aWxzLnB5) | `78.75% <50.00%> (-12.50%)` | :arrow_down: |
| [superset/sql\_lab.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQvc3FsX2xhYi5weQ==) | `78.92% <100.00%> (-2.62%)` | :arrow_down: |
| [superset/sql\_parse.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQvc3FsX3BhcnNlLnB5) | `96.12% <100.00%> (-0.96%)` | :arrow_down: |
| [superset/utils/dashboard\_import\_export.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQvdXRpbHMvZGFzaGJvYXJkX2ltcG9ydF9leHBvcnQucHk=) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [superset/key\_value/commands/upsert.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQva2V5X3ZhbHVlL2NvbW1hbmRzL3Vwc2VydC5weQ==) | `0.00% <0.00%> (-89.59%)` | :arrow_down: |
| [superset/key\_value/commands/update.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQva2V5X3ZhbHVlL2NvbW1hbmRzL3VwZGF0ZS5weQ==) | `0.00% <0.00%> (-89.37%)` | :arrow_down: |
| [superset/key\_value/commands/delete.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQva2V5X3ZhbHVlL2NvbW1hbmRzL2RlbGV0ZS5weQ==) | `0.00% <0.00%> (-85.30%)` | :arrow_down: |
| [superset/db\_engines/hive.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQvZGJfZW5naW5lcy9oaXZlLnB5) | `0.00% <0.00%> (-85.19%)` | :arrow_down: |
| [superset/key\_value/commands/delete\_expired.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQva2V5X3ZhbHVlL2NvbW1hbmRzL2RlbGV0ZV9leHBpcmVkLnB5) | `0.00% <0.00%> (-80.77%)` | :arrow_down: |
| [superset/dashboards/commands/importers/v0.py](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-c3VwZXJzZXQvZGFzaGJvYXJkcy9jb21tYW5kcy9pbXBvcnRlcnMvdjAucHk=) | `15.62% <0.00%> (-76.25%)` | :arrow_down: |
| ... and [276 more](https://codecov.io/gh/apache/superset/pull/20323/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) | |
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/superset/pull/20323?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/superset/pull/20323?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [1e5cacd...eab77ca](https://codecov.io/gh/apache/superset/pull/20323?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] villebro commented on a diff in pull request #20323: feat: safer insert RLS
Posted by GitBox <gi...@apache.org>.
villebro commented on code in PR #20323:
URL: https://github.com/apache/superset/pull/20323#discussion_r1006183775
##########
tests/unit_tests/sql_parse_tests.py:
##########
@@ -1221,6 +1222,151 @@ def test_has_table_query(sql: str, expected: bool) -> None:
assert has_table_query(statement) == expected
+@pytest.mark.parametrize(
Review Comment:
Reading through these tests I wonder how this handles aliases, something like
```
SELECT a.*, b.*
FROM tbl_a AS a
INNER JOIN tbl_b AS b ON a.col = b.col
```
also the shorthand form (or combo of them)
```
SELECT a.*, b.*
FROM tbl_a a
INNER JOIN tbl_b b ON a.col = b.col
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] betodealmeida commented on a diff in pull request #20323: feat: safer insert RLS
Posted by GitBox <gi...@apache.org>.
betodealmeida commented on code in PR #20323:
URL: https://github.com/apache/superset/pull/20323#discussion_r1042783345
##########
tests/unit_tests/sql_parse_tests.py:
##########
@@ -1221,6 +1222,151 @@ def test_has_table_query(sql: str, expected: bool) -> None:
assert has_table_query(statement) == expected
+@pytest.mark.parametrize(
Review Comment:
I added those two to the unit tests, it works as expected!
(I did have to update the mock `get_rls_for_table` to make it work, though!)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org