You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "john-bodley (via GitHub)" <gi...@apache.org> on 2023/08/04 15:41:47 UTC
[GitHub] [superset] john-bodley opened a new pull request, #24892: Revert "fix(embedded): adding logic to check dataset used by filters (#24808)
john-bodley opened a new pull request, #24892:
URL: https://github.com/apache/superset/pull/24892
<!---
Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/
Example:
fix(dashboard): load charts correctly
-->
### SUMMARY
This PR reverts https://github.com/apache/superset/pull/24808. Regrettably @Vitor-Avila after further review I believe the logic outlined in your fix (per the integration test you added) exposes a security vulnerability, i.e., per this check in your test,
```python
security_manager.raise_for_access(datasource=test_dataset)
```
will mean said user will have access to the `test_dataset` datasource irrespective of the context. Thus by granting dashboard access to to a guest user you would be in fact (possibly unknowingly) granting full access to all datasources which are referenced within the native dashboard filters.
I think the right—context aware—solution is to change the `raise_for_access` caller to include the dashboard context. Note in https://github.com/apache/superset/pull/24804 I've refactored the dashboard security logic by folding `raise_for_dashboard_access` into `raise_for_access` so the later is (or can be dashboard aware).
The TL;DR is your change flexes to accommodate the need for the dashboard filters to function but is over generous in terms of the context in which the permissions are allowed.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
<!--- Skip this if not applicable -->
### TESTING INSTRUCTIONS
CI.
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] codecov[bot] commented on pull request #24892: Revert "fix(embedded): adding logic to check dataset used by filters (#24808)
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #24892:
URL: https://github.com/apache/superset/pull/24892#issuecomment-1665827204
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/24892?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
> Merging [#24892](https://app.codecov.io/gh/apache/superset/pull/24892?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (9f7e40f) into [master](https://app.codecov.io/gh/apache/superset/commit/554ef07eeda094f5bcc081e7a265e0b7408e0868?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (554ef07) will **decrease** coverage by `10.70%`.
> The diff coverage is `0.00%`.
> :exclamation: Current head 9f7e40f differs from pull request most recent head 2d00c63. Consider uploading reports for the commit 2d00c63 to get more accurate results
```diff
@@ Coverage Diff @@
## master #24892 +/- ##
===========================================
- Coverage 69.00% 58.31% -10.70%
===========================================
Files 1906 1906
Lines 74142 74130 -12
Branches 8208 8208
===========================================
- Hits 51160 43227 -7933
- Misses 20859 28780 +7921
Partials 2123 2123
```
| Flag | Coverage Δ | |
|---|---|---|
| hive | `?` | |
| mysql | `?` | |
| postgres | `?` | |
| presto | `54.05% <0.00%> (+0.01%)` | :arrow_up: |
| python | `61.01% <0.00%> (-22.36%)` | :arrow_down: |
| sqlite | `?` | |
| unit | `55.01% <0.00%> (+0.01%)` | :arrow_up: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
| [Files Changed](https://app.codecov.io/gh/apache/superset/pull/24892?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [superset/security/manager.py](https://app.codecov.io/gh/apache/superset/pull/24892?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvc2VjdXJpdHkvbWFuYWdlci5weQ==) | `61.38% <0.00%> (-32.39%)` | :arrow_down: |
... and [293 files with indirect coverage changes](https://app.codecov.io/gh/apache/superset/pull/24892/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] john-bodley merged pull request #24892: fix: revert "fix(embedded): adding logic to check dataset used by filters (#24808)
Posted by "john-bodley (via GitHub)" <gi...@apache.org>.
john-bodley merged PR #24892:
URL: https://github.com/apache/superset/pull/24892
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org