Skip to content

Align SqlExecutionResultsCommand with sibling export commands #38908

@sha174n

Description

@sha174n

Summary

SqlExecutionResultsCommand.validate() does not call raise_for_access() before returning results, making it inconsistent with its two sibling commands:

  • SqlResultExportCommand (export.py:72) — calls raise_for_access()
  • StreamingSqlResultExportCommand (streaming_export_command.py:78) — calls raise_for_access()

Proposed fix

Add the same raise_for_access() check in SqlExecutionResultsCommand.validate() after the query is resolved, mirroring the pattern already established in the sibling commands.

try:
    self._query.raise_for_access()
except SupersetSecurityException as ex:
    raise SupersetErrorException(
        SupersetError(
            message=__("Cannot access the query"),
            error_type=SupersetErrorType.QUERY_SECURITY_ACCESS_ERROR,
            level=ErrorLevel.ERROR,
        ),
        status=403,
    ) from ex

Metadata

Metadata

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions