Repository navigation
Conversation
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![codeant-ai-for-open-source[bot]](https://avatars.githubusercontent.com/u/151810221?s=60&v=4){kind=small}
Contributor
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #45936 +/- ##
==========================================
- Coverage 65.35% 65.27% -0.08%
==========================================
Files 3083 3083
Lines 211333 211666 +333
Branches 49823 49904 +81
==========================================
+ Hits 138110 138175 +65
- Misses 70041 70306 +265
- Partials 3182 3185 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
github-actions
Bot
added
the
requires:rebase
sha174n
force-pushed
the
fix-sqllab-write-target-scoping
branch
from
November 10, 2026 15:48
49d3c4a to
b3bee62
Compare
github-actions
Bot
removed
the
requires:rebase
Add a write and DDL target access check, SupersetSecurityManager.raise_for_write_target_access, that the query execution paths call alongside the existing per-table check: SQL Lab execution (templated SQL is checked once, in its rendered form), MCP execute_sql, the alert query run, and alert create/update query validation, so validation and execution agree. It covers the target of a statement when that target is a registered physical dataset outside all of the user's grants (no datasource_access on it, no schema_access on its schema, no catalog_access on its catalog, checked against both the dataset's stored permissions and the ones computed for the target) and not owned by them. This includes each table a multi-table DELETE modifies, the tables a MySQL multi-table UPDATE qualifies its SET columns with (or its only table, when the other joined sources are derived tables), the table behind a T-SQL UPDATE or DELETE target alias, each INSERT ALL target, a COPY INTO table, both tables of ALTER TABLE ... SWAP WITH, the table of CREATE INDEX ... ON, a table or view being dropped, altered or replaced, and the targets of INSERT, UPDATE, DELETE or MERGE statements nested in a WITH clause. Target aliases are compared the way the dialect resolves identifiers (quoted names exactly, unquoted names normalized), and statement modifiers read as tables (TOP, QUICK, LOW_PRIORITY, ...) are only set aside in DELETE and UPDATE target lists. It parses and qualifies the SQL the same way as the per-table check and short-circuits on the same database-level access, before any parsing; SQL without any write or DDL target returns before rendering. Temporary and session objects, tables created earlier in the same script, unregistered tables, structure-copy sources and new-object creation are unchanged, as are T-SQL updatable CTEs of the statement's own WITH clause, and targets whose catalog is not known on an engine that models catalogs. Deployments that override the per-table check or configure an access hook (EXTRA_RAISE_FOR_ACCESS_BYPASS) keep their own semantics: the new check is skipped for them. The existing per-table check (raise_for_access, whose signature and body are unchanged) and result/export re-validation are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Render the template once, authorize that rendered string as well as the template, and hand it to the executor without template_params so it runs unchanged. Rendered SQL that still contains Jinja markup is rejected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sha174n
force-pushed
the
fix-sqllab-write-target-scoping
branch
from
November 11, 2026 11:36
55b1896 to
ea4f2d6
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Adds a write and DDL target access check,
SupersetSecurityManager.raise_for_write_target_access, that the query execution paths call alongside the existing per-table check: SQL Lab execution, MCPexecute_sql, the alert query run, and alert create/update query validation.The existing per-table check builds its table set from a statement's read sources (the
FROM/JOINreferences). The target a statement writes to, alters or drops is modelled elsewhere in the AST and is not part of that set. The new check covers that target when it is a registered physical dataset outside all of the user's grants (nodatasource_accesson it, noschema_accesson its schema, nocatalog_accesson its catalog) and not owned by them.Behaviour is unchanged for:
CREATE TABLE, CTAS, rename to a new name) and structure-copy sourcesraise_for_accessor configureEXTRA_RAISE_FOR_ACCESS_BYPASSraise_for_access(signature and body) and result/export re-validation are unchanged.TESTING INSTRUCTIONS
tests/unit_tests/sql/parse_tests.py: write/DDL target extraction across dialects (multi-tableUPDATE/DELETE, T-SQL target aliases,MERGE,INSERT ALL,COPY INTO,SWAP WITH,CREATE INDEX ... ON, CTE-nested DML, temporary objects, script-created tables).tests/unit_tests/security/manager_test.py: allow/deny matrix for the new check, including a corpus of statements that must keep working unchanged, custom security manager subclasses, the access hook, and result re-validation of an executed script.ADDITIONAL INFORMATION
🤖 Generated with Claude Code