24 lines
1.2 KiB
Diff
24 lines
1.2 KiB
Diff
# UNDF: UNDF-2026-000000815
|
|
# UNDF: (leave blank)
|
|
# superset-0001: SecurityManager._get_pvms_from_builtin_role pvm dedup O(Regex*PVMs*R)
|
|
# CWE-407: list membership check `pvm not in role_from_permissions` inside nested loop
|
|
# Fix: use a set for O(1) dedup lookup
|
|
--- a/superset/security/manager.py
|
|
+++ b/superset/security/manager.py
|
|
@@ -1347,6 +1347,7 @@
|
|
role_from_permissions_names = self.builtin_roles.get(role_name, [])
|
|
all_pvms = self.session.query(PermissionView).all()
|
|
role_from_permissions = []
|
|
+ role_from_permissions_ids = set()
|
|
for pvm_regex in role_from_permissions_names:
|
|
view_name_regex = pvm_regex[0]
|
|
permission_name_regex = pvm_regex[1]
|
|
@@ -1354,8 +1355,9 @@
|
|
if re.match(view_name_regex, pvm.view_menu.name) and re.match(
|
|
permission_name_regex, pvm.permission.name
|
|
):
|
|
- if pvm not in role_from_permissions:
|
|
+ if pvm.id not in role_from_permissions_ids:
|
|
role_from_permissions.append(pvm)
|
|
+ role_from_permissions_ids.add(pvm.id)
|
|
return role_from_permissions
|