EnxDev opened a new pull request, #44768: URL: https://github.com/apache/superset/pull/44768
### SUMMARY Follow-up to #44650, addressing a review comment from @alexandrusoare that went unaddressed before merge. `_is_correlated` decides whether a sub-query references an outer table by comparing each column's qualifier with the names in the enclosing scopes' `selected_sources`. An unaliased source in the outer query, such as a derived table with no alias (`FROM (SELECT * FROM a)`), is keyed `''` there. An unqualified column's `table` is also `''`, so every sub-query with an unqualified column matched it, looked correlated, and lost the global guest RLS rules. The fix only compares qualified columns. That matches what the docstring and UPDATING.md already say: an unqualified column can't be told apart from a local one, so it's treated as local and the sub-query gets the rules. Example, guest rule `org_id = 1` (global), virtual dataset SQL: ```sql SELECT x, (SELECT COUNT(*) FROM b WHERE v > 0) AS n FROM (SELECT * FROM a) ``` Before: the scalar sub-query over `b` wasn't scoped, so it counted rows from every tenant. After: it gets `b.org_id = 1`. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A ### TESTING INSTRUCTIONS ```bash pytest tests/unit_tests/sql/parse_tests.py -k test_rls_subquery_predicates pytest tests/unit_tests/security/guest_rls_test.py ``` New cases: - `unqualified-reference-beside-unaliased-derived-table` (scalar sub-query) - `in-subquery-beside-unaliased-derived-table` (`IN` sub-query) - `test_global_guest_rule_applied_to_subquery_beside_unaliased_derived_table` (end-to-end through the virtual dataset path) Without the fix, all three fail. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
