Bug description
When updating a dataset via the PUT /api/v1/dataset/<id>
endpoint, the request does not validate SQL query access permissions. As a result, users can update an existing dataset with a SQL query referencing tables they are not authorized to access. The update request is accepted without any validation errors. Currently, SQL validation and permission checks are performed only during dataset creation (POST /api/v1/dataset/
), but not during updates.
We encountered this issue in version 4.1.3, and after testing with the current master branch, we confirmed that the same problem still exists.
We previously contacted the team via email regarding this issue but did not receive a response. We also reported it via Slack. This is a critical security vulnerability for us, so we’re opening this issue here to formally track and discuss the problem.
Expected Behavior
The same access control logic implemented in the dataset creation endpoint using security_manager.raise_for_access()
should also be applied to the update endpoint.
Steps to Reproduce
- Create a dataset that you have permission to query.
- Send a
PUT /api/v1/dataset/<id>
request with a new SQL query referencing a table you don’t have permission to access. - Observe that the update succeeds without raising any access control errors.
Actual Behavior
The update request is accepted, and the dataset is updated even if the new SQL references unauthorized tables.
Proposed Solution
Apply the same access control logic from the create endpoint (security_manager.raise_for_access()
) to the update endpoint.
This will enforce SQL query validation during updates and align behavior between the two endpoints.
Screenshots/recordings
No response
Superset version
master / latest-dev
Python version
3.11
Node version
18 or greater
Browser
Chrome
Additional context
No response
Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
Comment From: ysinghc
I have a patch for this, will finish testing and push asap