madhushreeag commented on PR #44215:
URL: https://github.com/apache/superset/pull/44215#issuecomment-6296951237
@villebro : One more potential issue - a user who can edit a dashboard can
read the data of a dataset they have no grant on, by attaching a chart that
uses it. The attach path does not check chart access, and the new editor
inheritance then grants the dataset.
**Why the attach is unchecked** : `set_dash_metadata` rebuilds
`dashboard.slices` from the chart ids in the submitted `position_json` with no
`can_access_chart` gate, so an editor can attach a chart they can't read.
**Why that grants data**: Under promiscuous mode the new inheritance helpers
treat any chart on a dashboard the user edits as accessible, and their editor
leg is not published-gated.
**Reachability**: The UI chart picker is access-filtered (`ChartFilter`), so
this isn't clickable. Tt needs a crafted dashboard PUT, which the REST API
accepts.
**How I verified it**:
config:`ENABLE_VIEWERS=True`, `VIEWER_PROMISCUOUS_MODE=True`
Actors: user gamma (role: copy of Gamma, no datasource_access on dataset
cleaned_sales_data, id 397), chart 6813 on that dataset, empty dashboard 609
that gamma edits.
1. Baseline — gamma cannot read the chart (superset shell):
```
g.user = security_manager.find_user("gamma")
chart = db.session.get(Slice, 6813)
security_manager.can_access_chart(chart) #
False
security_manager._promiscuous_viewer_inherits_chart(chart) # False
security_manager._promiscuous_viewer_inherits_datasource(chart.datasource)
# False
```
Over HTTP, the direct read is blocked:
`GET /api/v1/chart/6813/data/ -> 404 (ChartFilter hides it)`
2. Attach via the real save path (HTTP, as gamma). A PUT carrying only
`position_json` does not attach (slice rebuild lives in `set_dash_metadata`,
which runs only when `json_metadata` is present). Sending
`json_metadata.positions` referencing `chartId: 6813` does:
PUT /api/v1/dashboard/609
```
{"json_metadata": "{\"positions\": { ...CHART node with
meta.chartId=6813... }}"}
-> 200
```
After this, dashboard 609 has slice 6813, with no access check having run.
3. gamma now reads the dataset (HTTP, as gamma):
```
POST /api/v1/chart/data
datasource {id:397,type:table}, form_data {slice_id:6813, dashboardId:609},
queries[0].metrics = COUNT(*)
-> 200 result[0].data = [{"COUNT": 2823}]
```
The scope is limited to what was attached. The same gamma session querying a
dataset not on the dashboard (id 387) returns 403 Forbidden. So this is the
dashboard-inheritance path, not a blanket bypass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
