bito-code-review[bot] commented on PR #43848:
URL: https://github.com/apache/superset/pull/43848#issuecomment-5588041792
<!-- Bito Reply -->
The flagged security issue is correct. The code changes implement type-aware
outer joins to ensure that charts on non-table datasources (like semantic
views) are correctly included in visibility filters. Because these joins are
outer joins, they can include rows where the datasource has been deleted,
potentially leaving stale `Slice.perm` values. However, as noted in the code
comments, the object-level access gate remains authoritative and will correctly
reject access to these charts, making this an accepted edge case shared with
the dashboard filter logic.
No further code changes are required to resolve this specific issue, as the
existing object-level gate provides the necessary security enforcement.
**superset/charts/filters.py**
```
# A chart whose
# datasource row is hard-deleted can still match its stale
# denormalized perm here; the object gate stays authoritative
# and denies (accepted edge, shared with the dashboard filter).
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
