QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-04-19 08:04:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce datasource access control in get_samples() (#36550)

Browse Source 
Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Evan Rusackas
2026-01-07 08:54:11 -08:00
committed by GitHub
parent d7d94ba640
commit 861e5cd013
3 changed files with 239 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
superset/views/datasource/utils.py
View File

@@ -153,6 +153,12 @@ def get_samples( # pylint: disable=too-many-arguments
)
try:
# Enforce access control before fetching data.
# This prevents users with "can samples on Datasource" permission from
# reading samples from datasets they don't have access to.
samples_instance.raise_for_access()
count_star_instance.raise_for_access()
count_star_data = count_star_instance.get_payload()["queries"][0]
if count_star_data.get("status") == QueryStatus.FAILED: