gabotorresruiz commented on PR #41753: URL: https://github.com/apache/superset/pull/41753#issuecomment-4907179779
Thanks @aminghadersohi, this was a good catch and it pushed me to re-check the whole guest surface On the **HIGH**: the dataset tools go through `user_can_view_data_model_metadata()` as step one, which returns `False` for a guest, so metadata and existence are never leaked. That path is solid On the **MEDIUM**: you were right about `get_chart_sql`. A chart's SQL exposes tables, columns and joins, the same class of data model detail we deny elsewhere, so I added an explicit `is_guest_user()` guard that holds even when `MCP_RBAC_ENABLED` is off rather than relying on RBAC alone While I was in there I swept the rest of the guest surface. The two RLS tools had the same shape of gap (an RLS clause exposes tables, columns and roles), so I closed those the same way. I also noticed the `Role` and `User` directory tools (`list_roles`, `get_role_info`, `list_users`, `get_user_info`) were reachable by a guest when RBAC is off, so I added them to the guest deny list, which is where `find_users` already lived, and added a test so the two deny lists cannot drift -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
