You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "lareii (via GitHub)" <gi...@apache.org> on 2025/10/08 06:42:31 UTC
[I] Dataset update endpoint missing SQL access validation [superset]
lareii opened a new issue, #35559:
URL: https://github.com/apache/superset/issues/35559
### Bug description
### Description
When updating a dataset via the `PUT /api/v1/dataset/<id>` endpoint, the request does not validate SQL query access permissions. As a result, users can update an existing dataset with a SQL query referencing tables they are not authorized to access. The update request is accepted without any validation errors. Currently, SQL validation and permission checks are performed only during dataset creation (`POST /api/v1/dataset/`), but not during updates.
We encountered this issue in version 4.1.3, and after testing with the current master branch, we confirmed that the same problem still exists.
We previously contacted the team via email regarding this issue but did not receive a response. We also reported it via Slack. This is a critical security vulnerability for us, so we’re opening this issue here to formally track and discuss the problem.
### Expected Behavior
The same access control logic implemented in the dataset creation endpoint using `security_manager.raise_for_access()` should also be applied to the update endpoint.
### Steps to Reproduce
1. Create a dataset that you have permission to query.
2. Send a `PUT /api/v1/dataset/<id>` request with a new SQL query referencing a table you don’t have permission to access.
3. Observe that the update succeeds without raising any access control errors.
### Actual Behavior
The update request is accepted, and the dataset is updated even if the new SQL references unauthorized tables.
### Proposed Solution
Apply the same access control logic from the create endpoint (`security_manager.raise_for_access()`) to the update endpoint.
This will enforce SQL query validation during updates and align behavior between the two endpoints.
### Screenshots/recordings
_No response_
### Superset version
4.1.3
### Python version
3.11
### Node version
18 or greater
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dataset update endpoint missing SQL access validation [superset]
Posted by "ysinghc (via GitHub)" <gi...@apache.org>.
ysinghc commented on issue #35559:
URL: https://github.com/apache/superset/issues/35559#issuecomment-3393382376
I have patch for this, will finish testing and push asap
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dataset update endpoint missing SQL access validation [superset]
Posted by "lareii (via GitHub)" <gi...@apache.org>.
lareii commented on issue #35559:
URL: https://github.com/apache/superset/issues/35559#issuecomment-3385667743
@dosubot
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dataset update endpoint missing SQL access validation [superset]
Posted by "lareii (via GitHub)" <gi...@apache.org>.
lareii closed issue #35559: Dataset update endpoint missing SQL access validation
URL: https://github.com/apache/superset/issues/35559
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dataset update endpoint missing SQL access validation [superset]
Posted by "lareii (via GitHub)" <gi...@apache.org>.
lareii commented on issue #35559:
URL: https://github.com/apache/superset/issues/35559#issuecomment-3400891121
Fixed with #35543.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org