cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
Anonymous
Not applicable

Validate URL Filter

I'm embedding reports using a URL filter to only show the data that the user is supposed to see. 

An iFrame with a url source is easy to manipulate and therefore a vulnerability so i've been testing different combinations of bad filters and querystrings.

I've found that if I pass a filter with a trailing whitespace character, or anything really that is not supposed to be in the filter, the filter is not applied and the report will show all the data.

Eg. http://localhost/Reports/powerbi/MyReport?filter=tableone/column in ('a', 'b', 'c') &rs:Embed=true

Is there any way of changing this behavior so that when a invalid filter is passed with the URL  no data will show in the report? 

 

At the moment the only solution I can think of is to test the filter with regex. And since I'm using custom security end up returning a 403 (I don't now how to return something else, like in this case a 400 Bad Request)

4 REPLIES 4
d_gosbell
Super User
Super User

If you want to restrict what the user can see you should look at implementing Row Level Security so that the permissions are enforced at the model level.

 

Because couldn't the user just grab the start of the URL and open the report directly in the portal (eg.  http://localhost/Reports/powerbi/MyReport) in a new browser window bypassing any logic on your page?

Anonymous
Not applicable

Yes, I need to look at RLS.

 

No I parse the URL looking for specific IDs which I then authorize using my security extension. But of course that could've been a real security miss.

 

Thank you!

jess_v
Frequent Visitor

@Anonymous   I've been tasked with parsing the Power BI URL and can't figure out how to do it.  Do you mind sharing how you achieved this?

 

(Essentially, there is a button in the Power BI report that links to additonal information, and I want to read the Power BI URL for a variable in there that will be used to create the dynamic link in the button).

 

Thanks! 

Anonymous
Not applicable

Not sure I understand what you mean but i simply just extract the URL from the IRSRequestContext and then do string validation on it using regex and other rules specificly for my purpose.

I do this in my implementation of IAuthenticationExtension2.GetUserInfo 

Helpful resources

Announcements
August 1 episode 9_no_dates 768x460.jpg

The Power BI Community Show

Watch the playback when Priya Sathy and Charles Webb discuss Datamarts! Kelly also shares Power BI Community updates.

Power BI Dev Camp Session 24 without aka link and time 768x460.jpg

Ted's Dev Camp - July 28, 2022

Watch Session 24 of Ted's Dev Camp along with past sessions!

Power Platform Conf 2022 768x460.jpg

Join us for Microsoft Power Platform Conference

The first Microsoft-sponsored Power Platform Conference is coming in September. 100+ speakers, 150+ sessions, and what's new and next for Power Platform.