codeant-ai-for-open-source[bot] commented on code in PR #43391:
URL: https://github.com/apache/superset/pull/43391#discussion_r3832406009
##########
superset/async_events/async_query_manager.py:
##########
@@ -238,24 +238,17 @@ def get_guest_user_channel_id(self, guest_user:
GuestUser) -> str:
secret so the value is unguessable to outside callers.
"""
token = guest_user.guest_token
- # ``iat`` uniquely identifies a guest token issuance, so it provides
- # per-token isolation while remaining stable across the lifetime of a
- # single embedded session.
- message = json.dumps(
- {
- "user": token.get("user"),
- "resources": token.get("resources"),
- "iat": token.get("iat"),
- "exp": token.get("exp"),
- "aud": token.get("aud"),
- # ``datasets`` and ``rev`` are optional scope claims, so tokens
- # that differ only in their dataset allowlist or revocation
- # version still derive distinct channels.
- "datasets": token.get("datasets"),
- "rev": token.get("rev"),
- },
- sort_keys=True,
- ).encode("utf-8")
+ # HMAC over the complete claim set so that tokens differing in *any*
+ # claim derive distinct channels. Enumerating claims here is unsafe:
+ # omitting one that scopes the session -- most importantly
+ # ``rls_rules``, the primary tenant-isolation mechanism for embedded
+ # dashboards -- would let two tenants' tokens minted in the same
+ # second with identical user/resources collide on one channel,
+ # exposing job events (including error strings) and cross-tenant
+ # cancellation. ``iat`` uniquely identifies a token issuance, so it
+ # provides per-token isolation while remaining stable across the
+ # lifetime of a single embedded session.
+ message = json.dumps(token, sort_keys=True).encode("utf-8")
Review Comment:
✅ **Customized review instruction saved!**
**Instruction:**
> Do not flag the use of `iat` and `exp` in async event channel derivation;
refresh-stable channels require a separate signed guest-token session claim and
token-schema change.
**Applied to:**
- `superset/async_events/async_query_manager.py`
---
💡 *To manage or update this instruction, visit: [CodeAnt AI
Settings](https://app.codeant.ai/org/settings/learnings)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
