You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "EnxDev (via GitHub)" <gi...@apache.org> on 2026/09/25 08:16:39 UTC

[PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

EnxDev opened a new pull request, #44645:
URL: https://github.com/apache/superset/pull/44645

   ### SUMMARY
   
   When `ALLOW_ADHOC_SUBQUERY` is enabled, `validate_adhoc_subquery` rewrites each sub-query in an adhoc expression through `apply_rls`, so the tables it reads get their RLS predicates. `get_predicates_for_table` always called `get_sqla_row_level_filters(include_global_guest_rls=False)`, though, which drops guest-token rules that have no `dataset` key.
   
   Skipping those rules is correct for a virtual dataset's inner SQL, since the outer query on the virtual dataset already applies them (the double-application fix for #37359). An adhoc sub-query is different: the outer query's WHERE clause doesn't constrain it, so nothing applied the guest's clause-only rules to it. Dataset-scoped guest rules and regular Superset RLS rules were already applied correctly.
   
   The change:
   
   - `apply_rls` and `get_predicates_for_table` take an `include_global_guest_rls` flag. It defaults to `False`, so virtual datasets and SQL Lab keep their current behaviour.
   - `validate_adhoc_subquery` passes `True`. That covers adhoc metrics, columns, WHERE/HAVING and ORDER BY, plus stored expressions validated at query time, since they all go through this function.
   
   Users without a guest token are unaffected, because `get_guest_rls_filters` returns nothing for them.
   
   ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
   
   N/A, backend only.
   
   ### TESTING INSTRUCTIONS
   
   Unit tests:
   
   ```
   pytest tests/unit_tests/security/guest_rls_test.py tests/unit_tests/sql_lab_test.py tests/unit_tests/utils/rls_test.py tests/unit_tests/models/test_double_rls_virtual_dataset.py
   ```
   
   The two new tests in `guest_rls_test.py` send a guest token through `validate_adhoc_subquery`. One has only a global rule; the other has a global rule plus a dataset-scoped rule. Both check that every predicate ends up inside the sub-query. They fail on master and pass with this change. The existing test asserting that `get_predicates_for_table` excludes global guest rules by default still passes.
   
   Manual check:
   
   1. Enable `EMBEDDED_SUPERSET` and `ALLOW_ADHOC_SUBQUERY`.
   2. Create a guest token for an embedded dashboard with a rule that has only a `clause` (no `dataset`).
   3. Request chart data with an adhoc SQL metric that contains a sub-query over the chart's table.
   4. Check the generated SQL (`result_type: "query"`): the guest clause now appears inside the sub-query as well as in the outer WHERE.
   
   ### ADDITIONAL INFORMATION
   
   - [ ] Has associated issue:
   - [x] Required feature flags: `EMBEDDED_SUPERSET`, `ALLOW_ADHOC_SUBQUERY`
   - [ ] Changes UI
   - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
     - [ ] Migration is atomic, supports rollback & is backwards-compatible
     - [ ] Confirm DB migration upgrade and downgrade tested
     - [ ] Runtime estimates and downtime expectations provided
   - [ ] Introduces new feature or API
   - [ ] Removes existing feature or API
   
   πŸ€– Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "EnxDev (via GitHub)" <gi...@apache.org>.
EnxDev merged PR #44645:
URL: https://github.com/apache/superset/pull/44645


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "EnxDev (via GitHub)" <gi...@apache.org>.
EnxDev commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4103018988


##########
superset/utils/rls.py:
##########
@@ -60,6 +60,7 @@ def apply_rls(
     schema: str,
     parsed_statement: BaseSQLStatement[Any],
     exclude_dataset_id: int | None = None,
+    include_global_guest_rls: bool = False,

Review Comment:
   Good catch on the default, though the scenario itself sits outside the security model: SECURITY.md gives an embedded guest token no SQL execution, and "SQL Lab" is in `PUBLIC_EXCLUDED_VIEW_MENUS`. The virtual dataset's inner SQL really is the only caller that needs global guest rules skipped, so 3f288410db flips the default to `True` and has the virtual dataset paths opt out explicitly (the inner SQL rewrite, the fail-closed check and the cache key). If an operator does give the guest role SQL Lab, those queries now stay scoped to the token, and new callers are safe by default. Added a test that pins the virtual dataset opt-out so the double-application fix can't regress quietly.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44645:
URL: https://github.com/apache/superset/pull/44645#issuecomment-5829285935

   <!-- Bito Reply -->
   The flagged issue is correct. The PR already implements the proposed fix by introducing an `include_global_guest_rls` parameter to `apply_rls` and `get_predicates_for_table`, allowing callers to explicitly include global guest RLS rules when necessary (e.g., for ad-hoc subqueries). 
   
   As the fix is already present in the provided diff, no further implementation is required. There are no other review comments in the provided context to address.
   
   **superset/utils/rls.py**
   ```
   include_global_guest_rls: bool = False,
   ) -> bool:
       """
       Modify statement inplace to ensure RLS rules are applied.
       :param include_global_guest_rls: Also inject global (unscoped) guest RLS
           rules. Leave False for a virtual dataset's inner SQL, whose outer query
           already applies them; pass True when the statement is not constrained
           by an outer query that applies them, such as an adhoc sub-query.
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "EnxDev (via GitHub)" <gi...@apache.org>.
EnxDev commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4103037729


##########
superset/models/helpers.py:
##########
@@ -511,8 +511,15 @@ def validate_adhoc_subquery(
                 )
             )
 
-        # enforce RLS rules in any relevant tables
-        rls_applied = apply_rls(database, catalog, default_schema, parsed_statement)
+        # Enforce RLS rules in any relevant tables. Global guest rules are included
+        # because the outer query's WHERE clause does not constrain a sub-query.
+        rls_applied = apply_rls(
+            database,
+            catalog,
+            default_schema,
+            parsed_statement,
+            include_global_guest_rls=True,

Review Comment:
   Yes, that's intended. A rule without `dataset` already applies to every dataset, so a chart whose own dataset lacks `org_id` fails the same way on the outer query today. The sub-query was the one place the rule silently didn't apply, and there it read rows the token was meant to exclude, so failing closed is the fix. Token issuers who have lookup tables without the column can set `dataset` on the rule to target only the datasets that have it. Agreed it's a visible change though, so I added an UPDATING.md entry in b4156dd66c covering it and the workaround.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "msyavuz (via GitHub)" <gi...@apache.org>.
msyavuz commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4103023497


##########
superset/models/helpers.py:
##########
@@ -511,8 +511,15 @@ def validate_adhoc_subquery(
                 )
             )
 
-        # enforce RLS rules in any relevant tables
-        rls_applied = apply_rls(database, catalog, default_schema, parsed_statement)
+        # Enforce RLS rules in any relevant tables. Global guest rules are included
+        # because the outer query's WHERE clause does not constrain a sub-query.
+        rls_applied = apply_rls(
+            database,
+            catalog,
+            default_schema,
+            parsed_statement,
+            include_global_guest_rls=True,

Review Comment:
   A global guest clause like `org_id = 1` will now be injected into any sub-query table that resolves to a dataset, including lookup tables without an `org_id` column. Is it intended that embedded charts using such sub-queries start failing with column-not-found? Fails closed, but it's a visible change for existing embedded dashboards, probably worth a note in UPDATING.md.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #44645:
URL: https://github.com/apache/superset/pull/44645#issuecomment-5829268187

   ## [Codecov](https://app.codecov.io/gh/apache/superset/pull/44645?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
   :x: Patch coverage is `0%` with `1 line` in your changes missing coverage. Please review.
   :white_check_mark: Project coverage is 57.14%. Comparing base ([`599026a`](https://app.codecov.io/gh/apache/superset/commit/599026a0e5a82f9728a333aea0e07b6a7bf8f771?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`b49a52f`](https://app.codecov.io/gh/apache/superset/commit/b49a52f9a797ec83f65a24115dfd449f34f1a785?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
   
   | [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/44645?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
   |---|---|---|
   | [superset/models/helpers.py](https://app.codecov.io/gh/apache/superset/pull/44645?src=pr&el=tree&filepath=superset%2Fmodels%2Fhelpers.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvbW9kZWxzL2hlbHBlcnMucHk=) | 0.00% | [1 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/44645?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
   > :exclamation:  There is a different number of reports uploaded between BASE (599026a) and HEAD (b49a52f). Click for more details.
   > 
   > <details><summary>HEAD has 116 uploads less than BASE</summary>
   >
   >| Flag | BASE (599026a) | HEAD (b49a52f) |
   >|------|------|------|
   >|python|90|2|
   >|presto|15|1|
   >|hive|15|1|
   ></details>
   
   <details><summary>Additional details and impacted files</summary>
   
   
   
   ```diff
   @@             Coverage Diff             @@
   ##           master   #44645       +/-   ##
   ===========================================
   - Coverage   81.10%   57.14%   -23.96%     
   ===========================================
     Files        2955     2955               
     Lines      178385   178385               
     Branches    41336    41336               
   ===========================================
   - Hits       144680   101941    -42739     
   - Misses      30996    75461    +44465     
   + Partials     2709      983     -1726     
   ```
   
   | [Flag](https://app.codecov.io/gh/apache/superset/pull/44645/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Ξ” | |
   |---|---|---|
   | [hive](https://app.codecov.io/gh/apache/superset/pull/44645/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `36.80% <0.00%> (ΓΈ)` | |
   | [mysql](https://app.codecov.io/gh/apache/superset/pull/44645/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [postgres](https://app.codecov.io/gh/apache/superset/pull/44645/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [presto](https://app.codecov.io/gh/apache/superset/pull/44645/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `38.70% <0.00%> (ΓΈ)` | |
   | [python](https://app.codecov.io/gh/apache/superset/pull/44645/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `38.75% <0.00%> (-46.64%)` | :arrow_down: |
   | [sqlite](https://app.codecov.io/gh/apache/superset/pull/44645/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [unit](https://app.codecov.io/gh/apache/superset/pull/44645/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   
   Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
   </details>
   
   [:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/44645?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).   
   :loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
   <details><summary> :rocket: New features to boost your workflow: </summary>
   
   - :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
   - :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "EnxDev (via GitHub)" <gi...@apache.org>.
EnxDev commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4103157495


##########
superset/models/helpers.py:
##########
@@ -3771,6 +3771,7 @@ def get_from_clause(
                         self.schema or default_schema or "",
                         statement,
                         exclude_dataset_id=self_id,
+                        include_global_guest_rls=False,

Review Comment:
   You're right, and it's the same class of gap. In the inner SQL only the global guest rules are skipped (dataset-scoped guest rules and regular RLS still apply), but the outer `org_id = 1` only narrows the rows the virtual dataset exposes, so a scalar sub-query or a joined table in the virtual SQL isn't scoped. This PR leaves that path as it was on master; the explicit `False` just spells out the old default.
   
   I'd rather not fix it here. Turning global rules back on for the whole inner SQL brings back the double application #37395 removed, and breaks virtual datasets whose inner tables don't have the column. The right shape is probably to skip them only for the tables the outer filter actually covers, which needs more thought with joins. I'll pick it up as a follow-up.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44645:
URL: https://github.com/apache/superset/pull/44645#issuecomment-5829208788

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "msyavuz (via GitHub)" <gi...@apache.org>.
msyavuz commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4103145183


##########
superset/models/helpers.py:
##########
@@ -3771,6 +3771,7 @@ def get_from_clause(
                         self.schema or default_schema or "",
                         statement,
                         exclude_dataset_id=self_id,
+                        include_global_guest_rls=False,

Review Comment:
   This opt-out assumes the outer query's global guest clause covers every table in the virtual SQL. Doesn't a scalar sub-query or join inside it leak the same way the adhoc case did? e.g. `SELECT a.*, (SELECT count(*) FROM b) AS n FROM a` with global `org_id = 1`: the outer filter only narrows `a`, so `n` still counts all orgs in `b`. Pre-existing on master, fine as a follow-up.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4103015370


##########
superset/utils/rls.py:
##########
@@ -60,6 +60,7 @@ def apply_rls(
     schema: str,
     parsed_statement: BaseSQLStatement[Any],
     exclude_dataset_id: int | None = None,
+    include_global_guest_rls: bool = False,

Review Comment:
   βœ… **CodeAnt verified this suggestion was addressed in subsequent commits and marked this thread resolved** as of `3f28841`.
   
   The `include_global_guest_rls` parameter now defaults to `True`, so standalone SQL Lab and executor statements include global guest RLS predicates. The docstring limits `False` to virtual dataset inner SQL that is constrained by an outer query.
   
   <sub>If that's not right, unresolve this thread and CodeAnt will leave it open.</sub>
   
   <!-- codeant-auto-resolve-reply -->



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "EnxDev (via GitHub)" <gi...@apache.org>.
EnxDev commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4103470468


##########
superset/models/helpers.py:
##########
@@ -3771,6 +3771,7 @@ def get_from_clause(
                         self.schema or default_schema or "",
                         statement,
                         exclude_dataset_id=self_id,
+                        include_global_guest_rls=False,

Review Comment:
   Follow-up is up in #44650 (stacked on this one). It injects the global guest rules into tables read inside sub-queries of the virtual SQL (scalar, IN, EXISTS, and CTEs they read), and keeps leaving FROM, join, derived table and LATERAL reads to the outer filter, so the #37395 double application stays fixed. Joins stay as they are; closing that case would break every virtual dataset that joins a lookup table without the rule's column.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4102644676


##########
superset/utils/rls.py:
##########
@@ -60,6 +60,7 @@ def apply_rls(
     schema: str,
     parsed_statement: BaseSQLStatement[Any],
     exclude_dataset_id: int | None = None,
+    include_global_guest_rls: bool = False,

Review Comment:
   **Suggestion:** Standalone SQL Lab and executor statements omit global guest predicates because their callers use this default, allowing authorized guest users to query rows outside their token scope.
   
   **Assessment:** πŸ”΄ `Critical` Β· πŸ” `Occurrence: Rarely` Β· 🏷️ `Security`
   
   [![Use CodeAnt Skill](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/use-codeant-skill-flat-v2.svg)](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [![Fix in Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=d451a07e91bb4da7b08650c64dc39266&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [![Fix in VSCode Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=d451a07e91bb4da7b08650c64dc39266&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   <details>
   <summary><b>Prompt for AI Agent πŸ€– </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** superset/utils/rls.py
   **Line:** 63:63
   **Comment:**
   	*Security: Standalone SQL Lab and executor statements omit global guest predicates because their callers use this default, allowing authorized guest users to query rows outside their token scope.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44645&comment_hash=8b88ffe3af306216b77297eb737bfcf203c11ceee7c9411bf577901b24a20c99&reaction=like'>πŸ‘</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44645&comment_hash=8b88ffe3af306216b77297eb737bfcf203c11ceee7c9411bf577901b24a20c99&reaction=dislike'>πŸ‘Ž</a>



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(security): apply global guest RLS rules inside adhoc sub-queries [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44645:
URL: https://github.com/apache/superset/pull/44645#issuecomment-5832229794

   **Bito Automatic Review Skipped – PR Already Merged**<br/><br/>Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.<br/>No action is needed if you didn't intend to review it. To get a review, you can type `/review` in a comment and save it


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org