How to implement post-processing in Apache Superset 1.5.0

Question

I am currently working on extending the current Apache Superset 1.5.0 version by a custom implementation of an anonymized column configuration (as seen in Figure 1 ). The intended idea is, that if a column in the dataset-editor is set to be anonymized, then superset should query the data as they are from the database but before sending them to the frontend, the particular column(s) should be anonymized.

I am already able to store that checkbox value in the database, since I am not familiar with the backend implementation, I don't know where to put the concrete implementation of the anonymization function.

I already found that the query result can be post-processed in query_context_processor.py , but how do I get the information then if a column is set to be anonymized?

Answer 1

This is not something trivial, and relying on post-processing wouldn't be safe — it could be easily bypassed by a malicious user, since post-processing is a request from the client side.

I believe the proper way to do this would be to extend the column model and add the anonymized attribute to it. Note that there is an ongoing effort to update the column model (along with other models), which complicates things a little bit, since you might need to also add the logic to the old model until the migration is complete. With this you would be able to determine which columns in a given dataset would need to be anonymized, and you could replace them with a function when the query object is built.

If you have only a few columns that you want to anonymize one way to do is creating a virtual dataset that has the anonymized column, and give access only to that dataset to the users, and not the underlying table. For example, you could write the following SQL:

SELECT
  user_id, user_username, HASH(user_email) AS anonymized_email, ...
FROM ...
...

And then save it as a virtual dataset.