codeant-ai-for-open-source[bot] commented on code in PR #43431: URL: https://github.com/apache/superset/pull/43431#discussion_r3838930503
########## superset/config.py: ########## @@ -2931,6 +2932,27 @@ def EMAIL_HEADER_MUTATOR( # pylint: disable=invalid-name,unused-argument # noq # async out per dashboard. GLOBAL_ASYNC_QUERIES_DEFAULT = True +# Realtime websocket transport (the `superset-websocket` server) config. +# When enabled, GTF task changes are pushed to the browser so charts and list +# views update without waiting for the interval poll (which stays as the +# fallback). Requires the superset-websocket server and a Redis coordination +# backend (DISTRIBUTED_COORDINATION_CONFIG). Two channel tiers: +# - a public per-entity-type pub/sub (e.g. entity-changes:task) for lossy +# list-view activity (opaque id + status), and +# - a per-principal channel (user:<id> / guest:<hmac>) for the dashboard +# chart-data path, authenticated by the JWT cookie below. +# The JWT authenticates the socket connection and binds it to its channel; the +# server delivers a per-principal channel's events only to that principal's +# sockets. Set a strong random WEBSOCKET_JWT_SECRET (>= 32 bytes) in production. +WEBSOCKET_ENABLED = False +WEBSOCKET_URL = "ws://127.0.0.1:8080/" +WEBSOCKET_JWT_SECRET = CHANGE_ME_WEBSOCKET_JWT_SECRET Review Comment: **Suggestion:** When `WEBSOCKET_ENABLED` is set to `True`, this default remains the publicly known `CHANGE_ME_WEBSOCKET_JWT_SECRET`, and the initialization path does not reject it. Attackers who know this value can forge channel JWTs and subscribe sockets to another principal's private channel. Add startup validation that refuses enabled deployments using the placeholder, or require an explicitly configured secret. [security] <details> <summary><b>Severity Level:</b> Critical 🚨</summary> ```mdx - ❌ Forged JWTs can access another user's private channel. - ❌ Dashboard chart-data events can become cross-user readable. ``` </details> [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) <details> <summary><b>Prompt for AI Agent 🤖 </b></summary> ```mdx This is a comment left during a code review. **Path:** superset/config.py **Line:** 2949:2949 **Comment:** *Security: When `WEBSOCKET_ENABLED` is set to `True`, this default remains the publicly known `CHANGE_ME_WEBSOCKET_JWT_SECRET`, and the initialization path does not reject it. Attackers who know this value can forge channel JWTs and subscribe sockets to another principal's private channel. Add startup validation that refuses enabled deployments using the placeholder, or require an explicitly configured secret. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43431&comment_hash=50559621176098c62fdb0ac60ebe860de0120856bc06cb8821aec8987c131fe6&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43431&comment_hash=50559621176098c62fdb0ac60ebe860de0120856bc06cb8821aec8987c131fe6&reaction=dislike'>👎</a> ########## superset/initialization/__init__.py: ########## @@ -1046,6 +1046,7 @@ def init_app_in_ctx(self) -> None: self.configure_ssh_manager() self.configure_stats_manager() self.configure_task_manager() + self.configure_websocket() Review Comment: **Suggestion:** The websocket cookie hook is now enabled for every configured websocket deployment, but the hook retains an existing token without checking whether its channel still matches the current principal. After a user logs out and another user logs in in the same browser, the old bearer cookie remains valid for up to the token expiration and the new websocket connection can continue using the previous user's channel, causing missed events or exposure of that user's private events. Clear or re-mint the cookie when the authenticated principal changes, and invalidate it on logout. [security] <details> <summary><b>Severity Level:</b> Critical 🚨</summary> ```mdx - ❌ User switching can expose prior user websocket events. - ❌ Dashboard chart completion details may reach the wrong principal. - ⚠️ Impact requires websocket transport deployment and logout/login reuse. ``` </details> [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) <details> <summary><b>Prompt for AI Agent 🤖 </b></summary> ```mdx This is a comment left during a code review. **Path:** superset/initialization/__init__.py **Line:** 1049:1049 **Comment:** *Security: The websocket cookie hook is now enabled for every configured websocket deployment, but the hook retains an existing token without checking whether its channel still matches the current principal. After a user logs out and another user logs in in the same browser, the old bearer cookie remains valid for up to the token expiration and the new websocket connection can continue using the previous user's channel, causing missed events or exposure of that user's private events. Clear or re-mint the cookie when the authenticated principal changes, and invalidate it on logout. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43431&comment_hash=9180e71a57688e8d89b403f0e5a8dc50b832ce6dd7601fdf76e9728f0103aebf&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43431&comment_hash=9180e71a57688e8d89b403f0e5a8dc50b832ce6dd7601fdf76e9728f0103aebf&reaction=dislike'>👎</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
