EnxDev commented on code in PR #44645:
URL: https://github.com/apache/superset/pull/44645#discussion_r4103018988
##########
superset/utils/rls.py:
##########
@@ -60,6 +60,7 @@ def apply_rls(
schema: str,
parsed_statement: BaseSQLStatement[Any],
exclude_dataset_id: int | None = None,
+ include_global_guest_rls: bool = False,
Review Comment:
Good catch on the default, though the scenario itself sits outside the
security model: SECURITY.md gives an embedded guest token no SQL execution, and
"SQL Lab" is in `PUBLIC_EXCLUDED_VIEW_MENUS`. The virtual dataset's inner SQL
really is the only caller that needs global guest rules skipped, so 3f288410db
flips the default to `True` and has the virtual dataset paths opt out
explicitly (the inner SQL rewrite, the fail-closed check and the cache key). If
an operator does give the guest role SQL Lab, those queries now stay scoped to
the token, and new callers are safe by default. Added a test that pins the
virtual dataset opt-out so the double-application fix can't regress quietly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
