rusackas opened a new pull request, #42930: URL: https://github.com/apache/superset/pull/42930
### SUMMARY A set of correctness fixes to request handling, embedded-dashboard scope, and per-user response caching. - Data-URL dataset imports validate the connected peer address (not just the hostname) on every hop, so a name that re-resolves between validation and fetch cannot reach an internal address. - The database OAuth2 callback binds token storage to the authenticated user that initiated the flow. - Redirect-safety normalises backslashes to slashes before its checks, matching how browsers treat them, so mixed slash/backslash prefixes are correctly rejected. - The task list fails closed for a request-bound principal with no user id, rather than returning everything. - Embedded (guest) requests are scoped correctly: annotation-layer reads require read access, native-filter series terms are validated like other value-returning terms, deck.gl multi-layer child charts bind to their own datasource, guest metric-macro dataset resolution is limited to datasets reachable through a granted dashboard, and annotation data is cached per requesting user. - Per-user extension storage responses are marked non-cacheable and excluded from shared-cache rewriting. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Not applicable (backend behavior). ### TESTING INSTRUCTIONS `pytest tests/unit_tests/utils/test_link_redirect.py tests/unit_tests/tasks/test_filters.py tests/unit_tests/extensions/ tests/unit_tests/commands/databases/oauth2_test.py tests/unit_tests/datasets/commands/importers/v1/import_test.py tests/unit_tests/security/manager_test.py tests/unit_tests/common/test_query_context_processor.py tests/unit_tests/jinja_context_test.py` ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
