haveitjoewei opened a new issue, #44433:
URL: https://github.com/apache/superset/issues/44433
## Summary
The `estimate_query_cost` endpoint in `superset/sqllab/api.py` is decorated
with `@protect()` for authentication but lacks a `@permission_name()` decorator
to enforce the specific `can_estimate_query_cost` permission defined in the
security manager.
## Severity
**Medium-High** - Missing authorization check allows users with basic SQL
Lab access to estimate query costs even if they shouldn't have that capability.
## Affected Files
- `superset/sqllab/api.py:150-160`
## Current Behavior
```python
@expose("/estimate/", methods=("POST",))
@protect()
@statsd_metrics
@requires_json
@event_logger.log_this_with_context(
action=lambda self, *args, **kwargs: (
f"{self.__class__.__name__}.estimate_query_cost"
),
log_to_statsd=False,
)
def estimate_query_cost(self) -> Response:
```
Compare with `format_sql` endpoint at line 203 which has proper permission
enforcement:
```python
@expose("/format_sql/", methods=("POST",))
@statsd_metrics
@protect()
@permission_name("read")
```
## Expected Behavior
The endpoint should enforce the `can_estimate_query_cost` permission as
defined in `superset/security/manager.py` (part of `SQLLAB_ONLY_PERMISSIONS`).
## Security Impact
While `@protect()` ensures authentication, it doesn't enforce the specific
`can_estimate_query_cost` permission. Users with basic SQL Lab access could
estimate query costs even if they shouldn't have that capability, potentially
enabling resource discovery attacks on the database.
## Proposed Fix
Add `@permission_name("can_estimate_query_cost")` or
`@permission_name("read")` decorator to the endpoint.
## Additional Context
Issue #36261 addressed missing permissions in the sql_lab role definition,
but the endpoint itself still lacks the permission decorator to enforce it at
the route level.
Generated with [Devin](https://devin.ai)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
