You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "EnxDev (via GitHub)" <gi...@apache.org> on 2026/10/23 06:59:19 UTC
[I] Re-check rendered SQL when a virtual dataset is authorized only by editorship [superset]
EnxDev opened a new issue, #45658:
URL: https://github.com/apache/superset/issues/45658
Follow-up from #45342 ([thread](https://github.com/apache/superset/pull/45342#discussion_r4299376456)).
### Problem
When a virtual dataset is saved, its SQL access check renders the template with the stored `template_params` only. Chart execution renders the same SQL with request-time context on top: `columns`, `groupby`, `metrics`, `filter`, `from_dttm`/`to_dttm`, `url_param()`, `filter_values()`, `current_username()` and so on. A template can branch on any of these, so the SQL that runs can read tables the save-time check never saw.
At execution time `raise_for_access(datasource=...)` accepts an editor of the dataset through `is_editor` (#20382) without looking at the rendered SQL, so nothing catches the other branch.
Example, with `ENABLE_TEMPLATE_PROCESSING` on and a role that has dataset write but no access to `public.customer_pii`:
```sql
{% if columns is defined %}
SELECT secret FROM public.customer_pii
{% else %}
SELECT 1 AS secret
{% endif %}
```
Create (and column sync) renders the `else` branch and passes. Chart-data renders the first branch and is authorized by editorship. Update, import and `/datasource/save/` behave the same way. With `url_param()` the caller picks the branch on every request, so no save-time rendering can bound what execution renders. This is not introduced by #45342; master behaves the same.
### Proposed fix
When a virtual dataset is authorized only by editorship, re-check the tables of the SQL that execution actually rendered, with `allow_dataset_editorship=False`. This changes runtime authorization for every virtual dataset an editor uses through #20382, so it needs to cover every execution path: chart-data, samples, drill to detail, exports and reports.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Re-check rendered SQL when a virtual dataset is authorized only by editorship [superset]
Posted by "EnxDev (via GitHub)" <gi...@apache.org>.
EnxDev closed issue #45658: Re-check rendered SQL when a virtual dataset is authorized only by editorship
URL: https://github.com/apache/superset/issues/45658
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org