xry1 opened a new issue, #42912:
URL: https://github.com/apache/superset/issues/42912

   ### Bug description
   
   ## Environment
   
   - Superset commit: `14583b6a5f6581896fa63163a002fb59f5f5f355`
   - Python: 3.11.15
   - SQLAlchemy: 1.4.54
   - PostgreSQL: 14.23
   - Function: `superset.commands.importers.v1.utils.import_tag`
   
   ## Description
   
   `import_tag` catches `SQLAlchemyError` after a query-triggered autoflush
   failure and continues using the same SQLAlchemy Session without rolling back
   or isolating the failed operation in a SAVEPOINT.
   
   This is reproducible with two concurrent tag-import operations. Both Sessions
   initially observe that the same `TaggedObject` association does not exist. 
One
   transaction commits first. The other receives a real PostgreSQL
   `UniqueViolation` on:
   
   `uix_tagged_object(tag_id, object_id, object_type)`
   
   `import_tag` catches the error and continues. The Session remains in 
SQLAlchemy's
   pending-rollback state, and the next Session operation raises
   `PendingRollbackError`.
   
   ## Reproduction result
   
   Parent behavior:
   
   - PostgreSQL raises `UniqueViolation`
   - `import_tag` catches `SQLAlchemyError`
   - the failed Session is reused
   - the worker reaches `PendingRollbackError`
   
   With a proposed `Session.begin_nested()` SAVEPOINT fix:
   
   - the failed per-tag operation is rolled back
   - both concurrent import operations complete
   - both tag associations remain persisted
   
   The complete `ImportAssetsCommand.run()` entrypoint shows the same behavior:
   the parent command converts the poisoned Session path to `ImportFailedError`,
   while the fixed version completes successfully.
   
   ## Expected behavior
   
   The failed per-tag operation should be isolated with a SAVEPOINT, or the
   Session should be rolled back before it is reused.
   
   A full outer `Session.rollback()` may discard unrelated imports, so a nested
   transaction appears safer for this importer path.
   
   This is a data-consistency and availability issue, not a security 
vulnerability.
   
   Related fixes:
   
   - https://github.com/apache/superset/pull/42675
   - https://github.com/apache/superset/pull/38934
   - https://github.com/apache/superset/pull/38859
   
   Those fixes address similar Session recovery problems in SQL Lab and MCP, but
   do not modify `import_tag`.
   
   ### Screenshots/recordings
   
   _No response_
   
   ### Superset version
   
   master / latest-dev
   
   ### Python version
   
   3.11
   
   ### Node version
   
   16
   
   ### Browser
   
   Chrome
   
   ### Additional context
   
   _No response_
   
   ### Checklist
   
   - [ ] I have searched Superset docs and Slack and didn't find a solution to 
my problem.
   - [x] I have searched the GitHub issue tracker and didn't find a similar bug 
report.
   - [x] I have checked Superset's logs for errors and if I found a relevant 
Python stacktrace, I included it here as text in the "additional context" 
section.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to