codeant-ai-for-open-source[bot] commented on code in PR #43458:
URL: https://github.com/apache/superset/pull/43458#discussion_r3854499454
##########
tests/unit_tests/security/test_permission_instructions_link.py:
##########
@@ -157,6 +159,19 @@ def
test_datasource_error_object_includes_sorted_owner_names() -> None:
error = sm.get_datasource_access_error_object(ds)
assert error.extra is not None
assert error.extra["owners"] == ["Amir Patel", "Zoe Chen"]
+ # Dataset name and id must not be present โ they would reveal a resource
+ # the user is not authorized to see.
+ assert "datasource_name" not in error.extra
+ assert "datasource" not in error.extra
Review Comment:
**Suggestion:** The new assertion only verifies that no `datasource` key
exists in `extra`, but the access link still contains the unauthorized dataset
ID (`id=12`). This allows the test to pass while the response continues
disclosing the resource identifier; assert that the generated link also omits
the datasource ID, or fix the link generation accordingly. [security]
<details>
<summary><b>Severity Level:</b> Minor ๐งน</summary>
```mdx
- โ Permission links still expose denied datasource IDs.
- โ ๏ธ Access-request systems receive identifiers via error payloads.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=e6b6e88ac73a426b89eb542f9e395e43&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=e6b6e88ac73a426b89eb542f9e395e43&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** tests/unit_tests/security/test_permission_instructions_link.py
**Line:** 165:165
**Comment:**
*Security: The new assertion only verifies that no `datasource` key
exists in `extra`, but the access link still contains the unauthorized dataset
ID (`id=12`). This allows the test to pass while the response continues
disclosing the resource identifier; assert that the generated link also omits
the datasource ID, or fix the link generation accordingly.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43458&comment_hash=f55649d420e932366d8da82895f062ec6f2be409068470412e0a40ac47847a17&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43458&comment_hash=f55649d420e932366d8da82895f062ec6f2be409068470412e0a40ac47847a17&reaction=dislike'>๐</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
