bito-code-review[bot] commented on PR #43689:
URL: https://github.com/apache/superset/pull/43689#issuecomment-5464452817
<!-- Bito Reply -->
The flagged security issue concerns stale routing state in the task-status
fanout mechanism. When a principal unsubscribes from a task, the system must
ensure that any per-tab routing entries associated with that principal are also
cleared to prevent unauthorized or stale status updates from being delivered to
those tabs.
To resolve this, you should ensure that the `on_unsubscribe` logic in
`superset-core/src/superset_core/tasks/subscription.py` (or the corresponding
task manager) explicitly reconciles or clears all routing entries for the
principal being unsubscribed. If you are using a custom `routing_channels`
implementation, ensure it returns `None` or an empty list when the principal is
no longer subscribed, triggering a fallback to principal-grain fanout or no
fanout at all, rather than returning stale per-tab keys.
Would you like me to fetch all comments on this PR to validate the rest of
the findings and implement a comprehensive fix?
**superset-core/src/superset_core/tasks/subscription.py**
```
def routing_channels(self, task: "Task") -> list[str] | None:
"""Realtime websocket routing keys for this task's status fanout.
Return ``None`` (the default) to keep principal-grain fanout — the
framework then derives one key per subscriber principal. A concrete
policy
that manages per-client keys should also return ``None`` (not an
empty
list) when it currently has no keys, so fanout falls back to
principal-grain rather than silently delivering to no one.
"""
return None
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
