rusackas commented on code in PR #43391:
URL: https://github.com/apache/superset/pull/43391#discussion_r3832403341
##########
superset/async_events/async_query_manager.py:
##########
@@ -238,24 +238,17 @@ def get_guest_user_channel_id(self, guest_user:
GuestUser) -> str:
secret so the value is unguessable to outside callers.
"""
token = guest_user.guest_token
- # ``iat`` uniquely identifies a guest token issuance, so it provides
- # per-token isolation while remaining stable across the lifetime of a
- # single embedded session.
- message = json.dumps(
- {
- "user": token.get("user"),
- "resources": token.get("resources"),
- "iat": token.get("iat"),
- "exp": token.get("exp"),
- "aud": token.get("aud"),
- # ``datasets`` and ``rev`` are optional scope claims, so tokens
- # that differ only in their dataset allowlist or revocation
- # version still derive distinct channels.
- "datasets": token.get("datasets"),
- "rev": token.get("rev"),
- },
- sort_keys=True,
- ).encode("utf-8")
+ # HMAC over the complete claim set so that tokens differing in *any*
+ # claim derive distinct channels. Enumerating claims here is unsafe:
+ # omitting one that scopes the session -- most importantly
+ # ``rls_rules``, the primary tenant-isolation mechanism for embedded
+ # dashboards -- would let two tenants' tokens minted in the same
+ # second with identical user/resources collide on one channel,
+ # exposing job events (including error strings) and cross-tenant
+ # cancellation. ``iat`` uniquely identifies a token issuance, so it
+ # provides per-token isolation while remaining stable across the
+ # lifetime of a single embedded session.
+ message = json.dumps(token, sort_keys=True).encode("utf-8")
Review Comment:
`iat`/`exp` have been part of this channel derivation since #41397, before
this PR touched it — this change only widens the hash to the full claim set to
close the `rls_rules` enumeration gap. A refresh-stable channel would need a
new signed session claim in the guest token itself, which is a separate
token-schema change outside what this PR is scoping.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
