You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "jacobroldan (via GitHub)" <gi...@apache.org> on 2025/03/20 06:57:53 UTC
[D] Is it possible to remove the field "query" in the result json ? [superset]
GitHub user jacobroldan created a discussion: Is it possible to remove the field "query" in the result json ?
If you open developer tool when you load a dashboard, you can see all requests from browser to server.
And there are some requests, the filters and charts, have in the response the query the server launched against the database:
So in those responses superset is showing the internal queries in the backend, although the user is a simple viewer without any permission. I think this is unnecessary information and publishing internal table names.
GitHub link: https://github.com/apache/superset/discussions/32765
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Is it possible to remove the field "query" in the result json ? [superset]
Posted by "jacobroldan (via GitHub)" <gi...@apache.org>.
GitHub user jacobroldan closed the discussion with a comment: Is it possible to remove the field "query" in the result json ?
Ok, I've seen this issue: https://github.com/apache/superset/pull/30858
It was added to branch 4.1 last week, so I think it will be in the next release. https://github.com/apache/superset/commit/804b653eca6d0640c1ebdd7db6c39cd99a749688
Thanks!
GitHub link: https://github.com/apache/superset/discussions/32765#discussioncomment-12673186
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Is it possible to remove the field "query" in the result json ? [superset]
Posted by "Nimishbansal-16 (via GitHub)" <gi...@apache.org>.
GitHub user Nimishbansal-16 closed the discussion with a comment: Is it possible to remove the field "query" in the result json ?
Hi @jacobroldan , this release was made for the data api in 4.1, but now I am using 5.0.0, and in this in dataset api, I can still see the query present in api response. Is this expected? When will this be fixed?
GitHub link: https://github.com/apache/superset/discussions/32765#discussioncomment-13572009
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Is it possible to remove the field "query" in the result json ? [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] closed the discussion with a comment: Is it possible to remove the field "query" in the result json ?
<!-- Greeting -->
Hi @khashashin! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
Superset currently removes the `query` field from the `/chart/data` API response for guest users, but this logic does not apply to other endpoints like the dataset API. In Superset 5.x, the dataset API still exposes the `query` (or `sql`) field to guest token users, and there is no global configuration to hide it automatically. To prevent exposing sensitive information in embedded dashboards, you would need to implement custom backend logic to filter out sensitive fields for guest users in the dataset API, similar to what was done for `/chart/data` in [PR #30858](https://github.com/apache/superset/pull/30858).
Best practices for securing embedded dashboards include restricting guest role permissions, applying Row Level Security (RLS) rules, and validating guest token parameters, but these do not guarantee removal of sensitive fields from all API responses. If you need to fully prevent exposure, endpoint-specific code changes are required in Superset as of 5.x.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/4deff1d2-321c-4a23-a2cc-2d62d2b6e7c6?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/4deff1d2-321c-4a23-a2cc-2d62d2b6e7c6?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/4deff1d2-321c-4a23-a2cc-2d62d2b6e7c6?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/4deff1d2-321c-4a23-a2cc-2d62d2b6e7c6?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/4deff1d2-321c-4a23-a2cc-2d62d2b6e7c6?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/4deff1d2-321c-4a23-a2cc-2d62d2b6e7c6?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/4deff1d2-321c-4a23-a2cc-2d62d2b6e7c6?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&
nbsp;[](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/32765)
GitHub link: https://github.com/apache/superset/discussions/32765#discussioncomment-14687642
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Is it possible to remove the field "query" in the result json ? [superset]
Posted by "khashashin (via GitHub)" <gi...@apache.org>.
GitHub user khashashin closed the discussion with a comment: Is it possible to remove the field "query" in the result json ?
@dosu is there any active PRs or discussions about this issue? Currently on version 5.0.0 the endpoint /api/v1/dashboard/3/datasets exposes the raw query under `sql` attribute of `result` response array:
```json
{
result: [{
"sql": "SELECT \r\n year,\r\n value as co2_emission_total_per_person\r\nFROM \"https://example.com/datasource.json\"",
}]
}
```
There is also other unnecessary information such:
```json
{
result: [{
"select_star": "SELECT\n *\nFROM main.\"EM City co2_emission_total_per_person\"\nLIMIT 100\nOFFSET 0",
"perm": "[EM City].[EM City co2_emission_total_per_person](id:4)",
"schema": "main",
"table_name": "EM City co2_emission_total_per_person",
"datasource_name": "EM City co2_emission_total_per_person",
}]
}
```
GitHub link: https://github.com/apache/superset/discussions/32765#discussioncomment-14688179
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Is it possible to remove the field "query" in the result json ? [superset]
Posted by "khashashin (via GitHub)" <gi...@apache.org>.
GitHub user khashashin closed the discussion with a comment: Is it possible to remove the field "query" in the result json ?
@dosu What should I do to prevent exposing the `query` and other sensitive information through guest token dashboard embedding?
GitHub link: https://github.com/apache/superset/discussions/32765#discussioncomment-14687555
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Is it possible to remove the field "query" in the result json ? [superset]
Posted by "jacobroldan (via GitHub)" <gi...@apache.org>.
GitHub user jacobroldan closed a discussion: Is it possible to remove the field "query" in the result json ?
If you open developer tool when you load a dashboard, you can see all requests from browser to server.
And there are some requests, the filters and charts, have in the response the query the server launched against the database:
So in those responses superset is showing the internal queries in the backend, although the user is a simple viewer without any permission. I think this is unnecessary information and publishing internal table names.
GitHub link: https://github.com/apache/superset/discussions/32765
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Is it possible to remove the field "query" in the result json ? [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Is it possible to remove the field "query" in the result json ?
<!-- Greeting -->
Hi @khashashin! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
Superset currently removes the `query` field from the `/chart/data` API response for guest users, but this logic does not apply to other endpoints like the dataset API. In Superset 5.x, the dataset API still exposes the `query` (or `sql`) field to guest token users, and there is no global configuration to hide it automatically. To prevent exposing sensitive information in embedded dashboards, you would need to implement custom backend logic to filter out sensitive fields for guest users in the dataset API, similar to what was done for `/chart/data` in [PR #30858](https://github.com/apache/superset/pull/30858).
Best practices for securing embedded dashboards include restricting guest role permissions, applying Row Level Security (RLS) rules, and validating guest token parameters, but these do not guarantee removal of sensitive fields from all API responses. If you need to fully prevent exposure, endpoint-specific code changes are required in Superset as of 5.x.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=4deff1d2-321c-4a23-a2cc-2d62d2b6e7c6) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/32765#discussioncomment-14687642
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org