mikebridge commented on PR #43887:
URL: https://github.com/apache/superset/pull/43887#issuecomment-5543551796
@aminghadersohi — this is the `DatabaseFilter` follow-up you flagged on
#43783 (the database branch of `_fetch_connection_items` being a bare
`db.session.query(Database)` while the semantic-layer branch was
access-filtered). Filed as sc-119878 and now up as this draft.
It applies `DatabaseFilter("id", SQLAInterface(Database)).apply(...)` to the
database branch — the same `base_filters` scoping `DatabaseRestApi` uses — so
the DB inventory is scoped the same way on every path. I kept your SECURITY.md
framing in the PR body (pre-existing, not a regression; principal Gamma / any
`can_read` role; in-scope authorization fix).
A 4-lens pass (preset-review for the security angle +
clean-code/tidy-first/python) reviewed it: preset-review confirmed the scoping
is correct and complete, matches DatabaseRestApi exactly, and — checked
specifically — the retained `sqlalchemy_uri` in `load_only` is NOT serialized
out, so no residual URI leak. Report filed in the spec repo. Left as a draft;
would appreciate your eyes when you have a moment, and I'll undraft on your
word.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
