rusackas opened a new pull request, #44036: URL: https://github.com/apache/superset/pull/44036
### SUMMARY Four independent fixes, bundled into one PR for review efficiency (each touches a different subsystem, no shared root cause): **`superset/db_engine_specs/base.py`, `gsheets.py`, `snowflake.py`, `config.py`** — a database's own `encrypted_extra.oauth2_client_info` sets `authorization_request_uri`/`token_request_uri` with no host validation. The token endpoint is POSTed to directly by the server, carrying the connection's `client_secret` in the body. Validates both endpoint hosts (`is_safe_host`, matching the existing pattern in `db_engine_specs/impala.py`'s `cancel_query` and `reports/notifications/webhook.py`) before use, with an opt-out config flag (`DATABASE_OAUTH2_ALLOW_INTERNAL_HOSTS`) for legitimately internal identity providers. **`superset/security/manager.py`** — `validate_guest_token_resources` only checked that a dashboard exists and is embedded, never that the principal minting the token actually has access to it. Adds a `raise_for_access(dashboard=...)` check. **`superset/commands/semantic_layer/update.py`** — masked configuration fields were restored from the stored value unconditionally, without checking whether other submitted fields also changed in the same request. Refuses to reveal a masked field when anything else in the payload differs from what's stored. **`superset/views/utils.py`** — `get_dashboard_extra_filters` resolved a dashboard by id with only a chart-membership check, no access check. Chart reuse across dashboards means chart access doesn't imply dashboard access. Adds a `raise_for_access(dashboard=...)` check, failing closed to an empty filter list. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A — backend-only changes, no UI impact. ### TESTING INSTRUCTIONS Regression tests added for all four; each was verified to fail without its corresponding fix and pass with it. ``` pytest tests/unit_tests/db_engine_specs/ tests/unit_tests/security/ tests/unit_tests/commands/semantic_layer/ tests/unit_tests/semantic_layers/ tests/unit_tests/views/ tests/unit_tests/commands/chart/ ``` 2718 passed, 1 skipped. ### ADDITIONAL INFORMATION - [ ] Has associated issue - [ ] Required feature flags - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Confirm DB Migration upgrade and downgrade tested - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
