security(sqllab): Missing @permission_name decorator on estimate_query_cost endpoint

Start in superset/sqllab/api.py around lines 150-160 and compare estimate_query_cost with the format_sql endpoint's permission decorator. Read the can_estimate_query_cost definition in superset/security/manager.py and confirm which permission the route should enforce. Done means the endpoint applies the intended permission check and its authorization behavior is verified.

Summary

The estimate_query_cost endpoint in superset/sqllab/api.py is decorated with @protect() for authentication but lacks a @permission_name() decorator to enforce the specific can_estimate_query_cost permission defined in the security manager.

Severity

Medium-High - Missing authorization check allows users with basic SQL Lab access to estimate query costs even if they shouldn't have that capability.

Affected Files

• superset/sqllab/api.py:150-160

Current Behavior

@expose("/estimate/", methods=("POST",))
@protect()
@statsd_metrics
@requires_json
@event_logger.log_this_with_context(
    action=lambda self, *args, **kwargs: (
        f"{self.__class__.__name__}.estimate_query_cost"
    ),
    log_to_statsd=False,
)
def estimate_query_cost(self) -> Response:

Compare with format_sql endpoint at line 203 which has proper permission enforcement:

@expose("/format_sql/", methods=("POST",))
@statsd_metrics
@protect()
@permission_name("read")

Expected Behavior

The endpoint should enforce the can_estimate_query_cost permission as defined in superset/security/manager.py (part of SQLLAB_ONLY_PERMISSIONS).

Security Impact

While @protect() ensures authentication, it doesn't enforce the specific can_estimate_query_cost permission. Users with basic SQL Lab access could estimate query costs even if they shouldn't have that capability, potentially enabling resource discovery attacks on the database.

Proposed Fix

Add @permission_name("can_estimate_query_cost") or @permission_name("read") decorator to the endpoint.

Additional Context

Issue #36261 addressed missing permissions in the sql_lab role definition, but the endpoint itself still lacks the permission decorator to enforce it at the route level.

Generated with Devin