xry1 opened a new issue, #42912: URL: https://github.com/apache/superset/issues/42912
### Bug description ## Environment - Superset commit: `14583b6a5f6581896fa63163a002fb59f5f5f355` - Python: 3.11.15 - SQLAlchemy: 1.4.54 - PostgreSQL: 14.23 - Function: `superset.commands.importers.v1.utils.import_tag` ## Description `import_tag` catches `SQLAlchemyError` after a query-triggered autoflush failure and continues using the same SQLAlchemy Session without rolling back or isolating the failed operation in a SAVEPOINT. This is reproducible with two concurrent tag-import operations. Both Sessions initially observe that the same `TaggedObject` association does not exist. One transaction commits first. The other receives a real PostgreSQL `UniqueViolation` on: `uix_tagged_object(tag_id, object_id, object_type)` `import_tag` catches the error and continues. The Session remains in SQLAlchemy's pending-rollback state, and the next Session operation raises `PendingRollbackError`. ## Reproduction result Parent behavior: - PostgreSQL raises `UniqueViolation` - `import_tag` catches `SQLAlchemyError` - the failed Session is reused - the worker reaches `PendingRollbackError` With a proposed `Session.begin_nested()` SAVEPOINT fix: - the failed per-tag operation is rolled back - both concurrent import operations complete - both tag associations remain persisted The complete `ImportAssetsCommand.run()` entrypoint shows the same behavior: the parent command converts the poisoned Session path to `ImportFailedError`, while the fixed version completes successfully. ## Expected behavior The failed per-tag operation should be isolated with a SAVEPOINT, or the Session should be rolled back before it is reused. A full outer `Session.rollback()` may discard unrelated imports, so a nested transaction appears safer for this importer path. This is a data-consistency and availability issue, not a security vulnerability. Related fixes: - https://github.com/apache/superset/pull/42675 - https://github.com/apache/superset/pull/38934 - https://github.com/apache/superset/pull/38859 Those fixes address similar Session recovery problems in SQL Lab and MCP, but do not modify `import_tag`. ### Screenshots/recordings _No response_ ### Superset version master / latest-dev ### Python version 3.11 ### Node version 16 ### Browser Chrome ### Additional context _No response_ ### Checklist - [ ] I have searched Superset docs and Slack and didn't find a solution to my problem. - [x] I have searched the GitHub issue tracker and didn't find a similar bug report. - [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
