bito-code-review[bot] commented on code in PR #44968:
URL: https://github.com/apache/superset/pull/44968#discussion_r4180655380
##########
superset/mcp_service/sql_lab/tool/execute_sql.py:
##########
@@ -210,12 +248,17 @@ async def execute_sql(request: ExecuteSqlRequest, ctx:
Context) -> ExecuteSqlRes
await ctx.error("Query could not be parsed for access
validation")
return _invalid_sql_response()
+ rendered_sql = await _authorize_rendered_sql(
Review Comment:
<!-- Bito Reply -->
The reasoning provided is correct. The two authorization checks serve
distinct purposes: the first acts as a gatekeeper to prevent the evaluation of
live macros in unauthorized queries, while the second authorizes the specific
rendered SQL that will be executed. Since these renders can involve different
tables, maintaining both checks is necessary for security and functional
correctness.
**superset/mcp_service/sql_lab/tool/execute_sql.py**
```
await ctx.error("Query could not be parsed for access validation")
return _invalid_sql_response()
+ rendered_sql = await _authorize_rendered_sql(
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
