github-advanced-security[bot] commented on code in PR #66289: URL: https://github.com/apache/airflow/pull/66289#discussion_r3177161209
########## ts-sdk/src/utils/jwt.ts: ########## @@ -0,0 +1,89 @@ +/*! + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +// JWT primitives for the Edge API. Signed per request with the shared +// secret; short TTL; `method` claim is the path minus `/edge_worker/v1/`. +// +// TODO(pr2): add Execution-API token refresh (self-sign + decode + near-expiry +// check). Server-issued tokens come in `command.token` and have a +// 10-min TTL — long tasks need to refresh before the token ages out. + +import { createHmac } from "node:crypto"; + +function b64urlEncode(input: Buffer | string): string { + return Buffer.from(input) + .toString("base64") + .replace(/=+$/, "") Review Comment: ## CodeQL / Polynomial regular expression used on uncontrolled data This [regular expression](1) that depends on [library input](2) may run slow on strings with many repetitions of '='. [Show more details](https://github.com/apache/airflow/security/code-scanning/597) ########## ts-sdk/src/worker-options.ts: ########## @@ -0,0 +1,77 @@ +/*! + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +// Worker option resolution: env-var fallbacks, validation, default merging. + +import { hostname } from "node:os"; +import { randomBytes } from "node:crypto"; +import type { StartWorkerOptions } from "./types.js"; + +export const DEFAULTS = { + pollIntervalInMs: 5_000, + heartbeatIntervalInMs: 30_000, + heartbeatFailureThreshold: 10, +} as const; + +export interface ResolvedWorkerOptions { + baseUrl: string; + secret: string; + workerName: string; + queues: string[]; + pollIntervalInMs: number; + heartbeatIntervalInMs: number; + heartbeatFailureThreshold: number; + jwtIssuer: string; +} + +export function resolveWorkerOptions(opts: StartWorkerOptions): ResolvedWorkerOptions { + // Normalize to the host root — SDK builds its own paths. + const rawBaseUrl = opts.baseUrl ?? process.env.AIRFLOW__EDGE__API_URL; + if (!rawBaseUrl) { + throw new Error("startWorker: baseUrl is required (pass in options or set AIRFLOW__EDGE__API_URL)"); + } + const baseUrl = rawBaseUrl.replace(/\/edge_worker\/v1.*$/, "").replace(/\/$/, ""); Review Comment: ## CodeQL / Polynomial regular expression used on uncontrolled data This [regular expression](1) that depends on [library input](2) may run slow on strings starting with '/edge_worker/v1' and with many repetitions of '/edge_worker/v1'. [Show more details](https://github.com/apache/airflow/security/code-scanning/598) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
