sha174n commented on code in PR #44496:
URL: https://github.com/apache/superset/pull/44496#discussion_r4068625763
##########
superset/sql/execution/executor.py:
##########
@@ -604,6 +604,19 @@ def _check_security(self, script: SQLScript, schema: str |
None = None) -> None:
)
)
+ # Rejected regardless of `allow_dml`: these do host file I/O, not DML.
+ if file_transfer_commands :=
script.get_client_file_transfer_commands():
Review Comment:
Not applying this one. `SQL_QUERY_MUTATOR` is an operator-supplied callable
from `superset_config.py`, not input any requesting principal controls, so it
sits inside the operator trust boundary rather than the role/capability matrix.
Every sibling gate in `_check_security` (disallowed functions, disallowed
tables, DML) validates pre-mutator in exactly the same way, and an operator
whose mutator can append `PUT` could equally append `DROP TABLE` past the DML
gate, so moving only this check post-mutator would be inconsistent without
closing anything.
Separately, b15764c4 does extend this check to statements carried as text
inside a nested command body, which the head-only match did miss.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
