Repository: apache/superset
File: superset/jinja_context.py (Python)

Code before:
    metric_key: str,
    dataset_id: int | None = None,
) -> str:
    """
    Given a metric key, returns its syntax.

    The ``dataset_id`` is optional and if not specified, will be retrieved
    from the request context (if available).

    :param metric_key: the metric key.
    :param dataset_id: the ID for the dataset the metric is associated with.
    :returns: the macro SQL syntax.
    """
    # pylint: disable=import-outside-toplevel
    from superset.daos.dataset import DatasetDAO

    if not dataset_id:
        dataset_id = get_dataset_id_from_context(metric_key)

    # Embedded user access is validated at the dashboard level, so we bypass
    # the regular DAO filter for them
    dataset = (
        DatasetDAO.find_by_id(dataset_id)
        if not security_manager.is_guest_user()
        else DatasetDAO.find_by_id(dataset_id, skip_base_filter=True)
    )
    if not dataset:
        raise DatasetNotFoundError(f"Dataset ID {dataset_id} not found.")

    metrics: dict[str, str] = {
        metric.metric_name: metric.expression for metric in dataset.metrics
    }
    if metric_key not in metrics:
        raise SupersetTemplateException(
            _(
                "Metric ``%(metric_name)s`` not found in %(dataset_name)s.",
                metric_name=metric_key,
                dataset_name=dataset.table_name,
            )
        )

    definition = metrics[metric_key]
    template = env.from_string(definition)
    definition = template.render(context)

    return definition


Review comment (security):
```suggestion
    dataset = DatasetDAO.find_by_id(
        dataset_id,
        skip_base_filter=security_manager.is_guest_user(),
    )
```

Code after:
    metric_key: str,
    dataset_id: int | None = None,
) -> str:
    """
    Given a metric key, returns its syntax.

    The ``dataset_id`` is optional and if not specified, will be retrieved
    from the request context (if available).

    :param metric_key: the metric key.
    :param dataset_id: the ID for the dataset the metric is associated with.
    :returns: the macro SQL syntax.
    """
    # pylint: disable=import-outside-toplevel
    from superset.daos.dataset import DatasetDAO

    if not dataset_id:
        dataset_id = get_dataset_id_from_context(metric_key)

    # Embedded user access is validated at the dashboard level, so we bypass
    # the regular DAO filter for them
    dataset = DatasetDAO.find_by_id(
        dataset_id,
        skip_base_filter=security_manager.is_guest_user(),
    )
    if not dataset:
        raise DatasetNotFoundError(f"Dataset ID {dataset_id} not found.")

    metrics: dict[str, str] = {
        metric.metric_name: metric.expression for metric in dataset.metrics
    }
    if metric_key not in metrics:
        raise SupersetTemplateException(
            _(
                "Metric ``%(metric_name)s`` not found in %(dataset_name)s.",
                metric_name=metric_key,
                dataset_name=dataset.table_name,
            )
        )

    definition = metrics[metric_key]
    template = env.from_string(definition)
    definition = template.render(context)

    return definition