You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "Ujjwaljain16 (via GitHub)" <gi...@apache.org> on 2026/09/07 21:39:06 UTC
[PR] fix(security): handle self-referential catalog qualifiers [superset]
Ujjwaljain16 opened a new pull request, #43974:
URL: https://github.com/apache/superset/pull/43974
### SUMMARY
DB engine specs without catalog support (e.g. `MssqlEngineSpec`, which has `supports_catalog = False` and implements no catalog methods) never create a catalog-qualified `catalog_access`/`schema_access` permission, and register datasets with `catalog=None` -- the only form the permission and dataset-creation flows ever produce for such engines.
But a dialect like T-SQL still allows (and sqlglot still parses) a fully qualified `database.schema.table` reference. A query that merely restates the connection's own database -- e.g. `abcm.dbo.temp` on a connection already pointed at `abcm` -- yields a non-empty parsed `catalog`. Checking that redundant value as a real catalog produces a `[db].[db].[schema]` permission string (or a dataset lookup filtered by that same catalog) that can never match the permission or dataset actually granted, denying access that should be authorized.
This fixes #31406: a user with `schema access on [abcm].[dbo]` (or a registered dataset + `datasource_access`) was denied when running `SELECT * FROM abcm.dbo.temp`, and had to be granted much broader database-wide access to work around it.
`raise_for_access` now normalizes a self-referential catalog (parsed catalog equal to the connection's own database, on an engine that doesn't support catalogs) to `None` once, up front, so both the `catalog_perm`/`schema_perm` check and the `SqlaTable.query_datasources_by_name` dataset lookup agree. A genuinely different database name (e.g. `another_db.dbo.temp`) is left untouched and still denied -- there is no permission format to authorize it for these engines, and this PR does not add one.
This PR intentionally does **not**:
- Change `force_dataset_match=True` (SQL Lab's stricter dataset-match requirement, #40409). That's a separate, later, deliberate hardening; schema access alone remains insufficient to execute a raw SQL Lab query without a matching registered dataset. This fix only ensures the dataset *lookup itself* isn't defeated by the same catalog-parsing artifact.
- Fix Row-Level Security's identical blind spot (`get_predicates_for_table` in `superset/utils/rls.py`, which also compares against `database.get_default_catalog()`, which is `None` for these engines -- meaning RLS rules can silently fail to apply to a catalog-qualified query). Same root cause, different code path and tests. Filing a separate issue for this, since it's a data-exposure concern in its own right and deserves independent review.
- Fix `DatasetDAO`'s dataset-uniqueness check (`daos/dataset.py`), which has the same blind spot at lower severity. Also a separate follow-up.
Keeping this PR scoped to the permission/dataset-lookup mismatch only.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A -- backend permission-check fix, no UI changes.
### TESTING INSTRUCTIONS
Added regression tests to `tests/unit_tests/security/manager_test.py` covering:
- catalog-qualified self-reference authorized by schema access
- unqualified form still works (no regression)
- a genuinely different database is still denied
- a cross-catalog join denies only the unauthorized side
- catalog-*supporting* engines (Postgres, etc.) are unaffected -- the legacy 2-part permission still doesn't satisfy a catalog-qualified query there, preserving SIP-95 semantics
- SQL Lab's `force_dataset_match=True` strictness is unchanged
- a registered dataset + `datasource_access` now correctly authorizes the self-referential-catalog case under `force_dataset_match=True` (the dataset-lookup half of the fix)
```
pytest tests/unit_tests/security/manager_test.py -v
```
### ADDITIONAL INFORMATION
- [x] Has associated issue: Fixes #31406
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5576029211
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/43974?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `33.33333%` with `2 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 66.32%. Comparing base ([`53070fa`](https://app.codecov.io/gh/apache/superset/commit/53070fa4c04c192118cb393c3e5bbe68eb1abbcb?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`54da164`](https://app.codecov.io/gh/apache/superset/commit/54da1647c67afda45ffb38f33d91de9038bf2053?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 4 commits behind head on master.
| [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/43974?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [superset/security/manager.py](https://app.codecov.io/gh/apache/superset/pull/43974?src=pr&el=tree&filepath=superset%2Fsecurity%2Fmanager.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvc2VjdXJpdHkvbWFuYWdlci5weQ==) | 33.33% | [1 Missing and 1 partial :warning: ](https://app.codecov.io/gh/apache/superset/pull/43974?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
> :exclamation: There is a different number of reports uploaded between BASE (53070fa) and HEAD (54da164). Click for more details.
>
> <details><summary>HEAD has 128 uploads less than BASE</summary>
>
>| Flag | BASE (53070fa) | HEAD (54da164) |
>|------|------|------|
>|python|90|3|
>|presto|15|1|
>|hive|14|1|
>|sqlite|15|1|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #43974 +/- ##
===========================================
- Coverage 79.81% 66.32% -13.50%
===========================================
Files 2914 2914
Lines 170467 170470 +3
Branches 39518 39519 +1
===========================================
- Hits 136060 113065 -22995
- Misses 31885 55057 +23172
+ Partials 2522 2348 -174
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/43974/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/43974/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `37.63% <33.33%> (-0.01%)` | :arrow_down: |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/43974/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/43974/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/43974/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `39.51% <33.33%> (-0.01%)` | :arrow_down: |
| [python](https://app.codecov.io/gh/apache/superset/pull/43974/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `57.19% <33.33%> (-27.01%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/43974/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `57.06% <33.33%> (-0.01%)` | :arrow_down: |
| [unit](https://app.codecov.io/gh/apache/superset/pull/43974/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/43974?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "Ujjwaljain16 (via GitHub)" <gi...@apache.org>.
Ujjwaljain16 commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5587142721
@rebenitez1802
Thanks for the review i dug a bit deeper into the URI/database identity issue and i think i found an important constraint before i change the implementation
for the exact URI from the issue:
`mssql+pyodbc://SuperSet:***@abcm`
SQLAlchemy parses `abcm` as the **host**, with `url_object.database = None`
i also checked the other MSSQL connection styles Superset supports
there seem to be three cases:
* `mssql+pymssql://.../abcm` → the database is available from the URL
* `mssql+pyodbc:///?odbc_connect=...;Database=abcm;...` → the database is available inside the ODBC connection string.
* `mssql+pyodbc://SuperSet:***@abcm` → there isn't actually any database information in the URI/config. `abcm` is the host/DSN, and the real database comes from the SQL Server login's default database
i also looked at using `database.database_name` as a fallback
i don't think that's safe: Superset treats that as the name/identifier of the Superset connection and it can be renamed independently of the underlying database
using it as an authorization identity could therefore potentially turn a previously denied cross-database reference into an allowed one
the cleanest approach i found is to add a small engine-spec hook, similar to the existing `get_schema_from_engine_params()`, which resolves the database only when it's actually present in the connection configuration (URL database, `connect_args`, or `Database=` in `odbc_connect`). `raise_for_access()` can then normalize the catalog only when it matches that statically-known database.
The catch is that this **doesn't make the exact host/DSN-only URI from the issue work**. To safely determine its actual database we'd need to connect to SQL Server and resolve the login's default database, which would introduce live I/O into the authorization path.
before i implement this would you be comfortable with the PR being scoped to the statically-resolvable MSSQL cases, while leaving the host/DSN-only case fail-closed and documenting it as a limitation?
If the expectation is that the literal URI in #31406 must also work i think we should discuss the live-resolution approach separately first, rather than introducing a heuristic that could affect authorization.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5580753302
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers an incremental AI Review.
- `/review full` - Manually triggers a full AI Review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "gabotorresruiz (via GitHub)" <gi...@apache.org>.
gabotorresruiz commented on code in PR #43974:
URL: https://github.com/apache/superset/pull/43974#discussion_r3992845991
##########
superset/db_engine_specs/mssql.py:
##########
@@ -194,6 +195,82 @@ def fetch_data(
# Lists of `pyodbc.Row` need to be unpacked further
return cls.pyodbc_rows_to_tuples(data)
+ @classmethod
+ def get_catalog_from_engine_params(
+ cls,
+ sqlalchemy_uri: URL,
+ connect_args: dict[str, Any],
+ ) -> str | None:
+ """
+ Resolve the database from genuine, statically-configured connection
+ settings only: an explicit ``connect_args["database"]``, a
+ ``Database=``/``Initial Catalog=`` entry embedded in the documented
+ ``odbc_connect`` connection-string query parameter, or the URL's own
+ database segment.
+
+ The check order mirrors ``MSDialect_pyodbc.create_connect_args``'s
+ actual precedence, not just plausibility:
+
+ - ``connect_args`` is always appended, as extra keyword arguments, to
+ whatever connection string SQLAlchemy hands to ``pyodbc.connect()``
+ -- regardless of whether that string came from the URL or from
+ ``odbc_connect`` -- so a duplicate key there wins over both.
+ - When ``odbc_connect`` is present, SQLAlchemy uses it as the *entire*
+ connection string and never looks at the URL's host/database
+ segments at all, so it must be checked before falling back to
+ ``sqlalchemy_uri.database``.
+
+ Returns None when none of these statically state a database -- e.g. a
+ host/DSN-only URI that relies on the SQL login's server-side default
+ database. That default is only known to SQL Server itself, at connect
+ time; resolving it would require a live query, which this method
+ deliberately does not perform.
+ """
+ if isinstance(database := connect_args.get("database"), str) and database:
Review Comment:
Just a small question, not a blocker: are we certain `connect_args["database"]` actually wins over an `odbc_connect` embedded `Database=` at the driver level? What I could verify is that SQLAlchemy uses `odbc_connect` as the entire connection string and passes `connect_args` on as extra `pyodbc.connect()` kwargs, which pyodbc appends to the end of that string. The ODBC `SQLDriverConnect` spec says a driver uses the first occurrence of a repeated keyword, which would make the `odbc_connect` value win, the opposite of the order encoded here and in `test_get_catalog_from_engine_params_connect_args_wins_over_odbc_connect`. I could not test against a live SQL Server, so you may well know better.
It only matters when an admin configures both sources with different databases, which is already a contradictory setup. But since this feeds an authorization decision, cheap insurance would be to return `None` whenever both sources are present and disagree, so the normalization simply never fires and we keep the pre-existing denial:
```python
if odbc_database and connect_args_database and odbc_database != connect_args_database:
return None
```
Happy to dig into the actual msodbcsql behavior with you if you think it is worth pinning down.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "Ujjwaljain16 (via GitHub)" <gi...@apache.org>.
Ujjwaljain16 commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5600711468
thanks again for the review and for confirming the proposed direction
i have pushed the updated implementation based on the agreed approach
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5639835024
<!-- Bito Reply -->
Your analysis of the ODBC connection string precedence is correct. According to the `SQLDriverConnect` specification, the driver typically respects the first occurrence of a keyword, meaning an embedded `Database=` in the `odbc_connect` string would indeed take precedence over a keyword argument passed to `pyodbc.connect()`.
Since this logic is used for authorization decisions, adding a safety check to return `None` when both sources are present and disagree is a prudent approach to avoid incorrect normalization. You may want to implement that check as you suggested to ensure the system defaults to a safer state in ambiguous configurations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "Ujjwaljain16 (via GitHub)" <gi...@apache.org>.
Ujjwaljain16 commented on code in PR #43974:
URL: https://github.com/apache/superset/pull/43974#discussion_r4023008242
##########
superset/db_engine_specs/mssql.py:
##########
@@ -194,6 +195,82 @@ def fetch_data(
# Lists of `pyodbc.Row` need to be unpacked further
return cls.pyodbc_rows_to_tuples(data)
+ @classmethod
+ def get_catalog_from_engine_params(
+ cls,
+ sqlalchemy_uri: URL,
+ connect_args: dict[str, Any],
+ ) -> str | None:
+ """
+ Resolve the database from genuine, statically-configured connection
+ settings only: an explicit ``connect_args["database"]``, a
+ ``Database=``/``Initial Catalog=`` entry embedded in the documented
+ ``odbc_connect`` connection-string query parameter, or the URL's own
+ database segment.
+
+ The check order mirrors ``MSDialect_pyodbc.create_connect_args``'s
+ actual precedence, not just plausibility:
+
+ - ``connect_args`` is always appended, as extra keyword arguments, to
+ whatever connection string SQLAlchemy hands to ``pyodbc.connect()``
+ -- regardless of whether that string came from the URL or from
+ ``odbc_connect`` -- so a duplicate key there wins over both.
+ - When ``odbc_connect`` is present, SQLAlchemy uses it as the *entire*
+ connection string and never looks at the URL's host/database
+ segments at all, so it must be checked before falling back to
+ ``sqlalchemy_uri.database``.
+
+ Returns None when none of these statically state a database -- e.g. a
+ host/DSN-only URI that relies on the SQL login's server-side default
+ database. That default is only known to SQL Server itself, at connect
+ time; resolving it would require a live query, which this method
+ deliberately does not perform.
+ """
+ if isinstance(database := connect_args.get("database"), str) and database:
Review Comment:
@gabotorresruiz
one additional detail came up while pinning down the precedence:
SQLAlchemy also accepts `database` as a URL query parameter, and `PyODBCConnector` merges `url.query` after the path-derived options so a conflicting `?database=query_db` actually overrides a path-segment `database=path_db` in the connection string
i included that in the same precedence fix, along with coverage for the query-param-only, query-param vs `connect_args`, query-param vs path and empty query-param cases
everything is ready for another look....
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "Ujjwaljain16 (via GitHub)" <gi...@apache.org>.
Ujjwaljain16 commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5663972705
@gabotorresruiz
thanks for the review and approval
i followed up on the `odbc_connect` vs `connect_args["database"]` precedence question and verified the behavior against SQLAlchemy 2.0.52 + the Microsoft ODBC Driver 18 for SQL Server
the implementation now follows the actual runtime precedence:
* embedded `Database=` in `odbc_connect` wins (including an explicitly empty value, which fails closed)
* otherwise the URL database is used
* `connect_args["database"]` is only a fallback when the connection string has no database
* `Initial Catalog=` is intentionally not recognized, since it isn't a valid database-selection keyword for this ODBC driver
i also added regression coverage for duplicate `Database=` keys and, importantly, a `raise_for_access()`-level test covering conflicting `odbc_connect` and `connect_args` values
the changes are now ready for another look
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "gabotorresruiz (via GitHub)" <gi...@apache.org>.
gabotorresruiz commented on code in PR #43974:
URL: https://github.com/apache/superset/pull/43974#discussion_r4020329977
##########
superset/db_engine_specs/mssql.py:
##########
@@ -194,6 +195,82 @@ def fetch_data(
# Lists of `pyodbc.Row` need to be unpacked further
return cls.pyodbc_rows_to_tuples(data)
+ @classmethod
+ def get_catalog_from_engine_params(
+ cls,
+ sqlalchemy_uri: URL,
+ connect_args: dict[str, Any],
+ ) -> str | None:
+ """
+ Resolve the database from genuine, statically-configured connection
+ settings only: an explicit ``connect_args["database"]``, a
+ ``Database=``/``Initial Catalog=`` entry embedded in the documented
+ ``odbc_connect`` connection-string query parameter, or the URL's own
+ database segment.
+
+ The check order mirrors ``MSDialect_pyodbc.create_connect_args``'s
+ actual precedence, not just plausibility:
+
+ - ``connect_args`` is always appended, as extra keyword arguments, to
+ whatever connection string SQLAlchemy hands to ``pyodbc.connect()``
+ -- regardless of whether that string came from the URL or from
+ ``odbc_connect`` -- so a duplicate key there wins over both.
+ - When ``odbc_connect`` is present, SQLAlchemy uses it as the *entire*
+ connection string and never looks at the URL's host/database
+ segments at all, so it must be checked before falling back to
+ ``sqlalchemy_uri.database``.
+
+ Returns None when none of these statically state a database -- e.g. a
+ host/DSN-only URI that relies on the SQL login's server-side default
+ database. That default is only known to SQL Server itself, at connect
+ time; resolving it would require a live query, which this method
+ deliberately does not perform.
+ """
+ if isinstance(database := connect_args.get("database"), str) and database:
Review Comment:
Thanks @Ujjwaljain16 for pinning this down against the real driver, that settles it far better than my spec reading did. My approval stands.
I verified the delta independently on this branch:
* The reordered hook matches how the positional connection string is really built. I checked `PyODBCConnector.create_connect_args` on SQLAlchemy 2.0.52, which is exactly what `requirements/base.txt` pins: `odbc_connect` becomes the entire string, a host URL with a database bakes `Database=<db>` in positionally, and a host-only URL becomes a `dsn=` string with no `Database=` at all, so the `connect_args` fallback really is what the driver connects to in that last case.
* All three affected suites pass at `d2a2327` (283 tests). Running the updated test files against the previous commit `723e6b2` fails exactly the six precedence tests, including the new `raise_for_access` level conflict test, so the coverage genuinely pins this fix.
* Adversarial probes all keep the pre-existing denial: repeated `odbc_connect` query params, non-string `connect_args["database"]` values, a bare `Database` token without `=`, an empty `Database=` alongside a conflicting `connect_args`, and an unclosed brace value all resolve to `None` or to a value that can never match a parsed catalog.
Good catch on `Initial Catalog=` being an OLEDB/ADO.NET keyword. Dropping it also closes a subtle over-grant in the version I approved: had the driver silently ignored it and connected to the login's default database, the old parser reported a database the connection never used, and the normalization could have fired on it.
One tiny leftover in the same contradictory-config family, not a blocker and fine as a follow-up or a wontfix: SQLAlchemy also accepts the database as a URL query parameter. On 2.0.52, `mssql+pyodbc://u:p@host?database=realdb&driver=...` builds `Database=realdb` into the positional string while `URL.database` stays `None`, so with a conflicting `connect_args["database"]` the hook falls through and reports the `connect_args` value the driver never uses. Superset only documents the path form, so I would not hold the PR on it; if you want cheap insurance, checking `sqlalchemy_uri.query.get("database")` before the `connect_args` fallback would cover it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5620416213
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers an incremental AI Review.
- `/review full` - Manually triggers a full AI Review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "gabotorresruiz (via GitHub)" <gi...@apache.org>.
gabotorresruiz commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5589926371
Hi @Ujjwaljain16, thanks for the careful work here, and especially for digging into the three URI forms yourself. Good catch on the rename hazard with `database_name` too.
I verified the mechanics on this branch independently: `make_url("mssql+pyodbc://SuperSet:pw@abcm")` yields `database=None` and this branch's `raise_for_access` still denies the issue's repro; the `odbc_connect` style yields `database=''` (empty string, not None) and is denied as well; the path form is authorized correctly, and that is the form in `MssqlEngineSpec`'s own suggested connection string, so the fix as written has real value. 3 of the 7 new tests fail on master, so the regression guards are genuine.
On your scoping question: yes, I would be comfortable with an engine-spec hook that resolves the database only when it is statically present in the connection config, leaving the host/DSN-only case fail-closed and documented. There is direct precedent in `get_schema_from_engine_params`, and I agree live resolution of the login's default database has no place in the authorization path. Three asks to go with it: handle the `odbc_connect` case explicitly (empty string, not None); build at least one test from a real URI through `make_url` instead of hardcoding `url_object.database` on the mock, per Renata's review; and change "Fixes #31406" to "partially addresses", noting the limitation on the issue so it does not auto-close with the reporter's config still broken.
I also agree with keeping the comparison exact rather than case-folding: a false negative falls back to the pre-existing denial, while a wrong case-fold would teach the check to merge two distinct databases. Happy to take another look once the hook version is up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5695055760
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers an incremental AI Review.
- `/review full` - Manually triggers a full AI Review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5614817343
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 723e6b2de4d7263ab3e21e9fba965e6826e367fd |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6aa25bdd4b222c00085b4844 |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-43974--superset-docs-preview.netlify.app](https://deploy-preview-43974--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DctBCoAgEADAv-w5yWyL6Ac9Y3WtBE2zgiL6e97mMi-kHEM6YQSoQGfazFo8u7s2dJKPi9gv8m52lsVhVhtIJJuDaBuUfSlsk4_PxCX1RKrTzKiVUkZKOXQaB0T4fg) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-43974--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5586496163
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers an incremental AI Review.
- `/review full` - Manually triggers a full AI Review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5575870073
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "Ujjwaljain16 (via GitHub)" <gi...@apache.org>.
Ujjwaljain16 commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5581394440
as per bito code review additional suggestion:
that's literally the case this fix is meant to handle
i went back and forth on this, but ended up leaving it exact on purpose
the two ways this can go wrong aren't equally bad here
if it stays too strict, worst case someone hits the same denial they'd get today annoying but not new
if i make it case-insensitive and am wrong about some engine's collation i have just taught the authorization check to treat two different databases as the same one that's a much scarier failure to ship
and "same database, different case" isn't really something python can decide on its own it depends on the engine's collation, which is configurable
MSSQL happens to default to case-insensitive but that's a default, not a guarantee, so i didn't want to bake that assumption in even just for MSSQL.
i did look at denormalize_name first, hoping it'd solve this for free but it's solving a different problem (round-tripping identifiers through SQLAlchemy's reflection layer), not "are these two names equal under this engine's collation."
since we don't have anything in the codebase that actually knows that, i left the comparison exact and added a comment explaining the reasoning
if it's worth fixing for MSSQL specifically, i think it deserves a real design pass around collation rather than a .casefold() slapped on here happy to take that on separately if it's wanted...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5613059642
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers an incremental AI Review.
- `/review full` - Manually triggers a full AI Review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #43974:
URL: https://github.com/apache/superset/pull/43974#issuecomment-5666490434
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers an incremental AI Review.
- `/review full` - Manually triggers a full AI Review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(security): handle self-referential catalog qualifiers [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #43974:
URL: https://github.com/apache/superset/pull/43974
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org