potiuk commented on PR #67620: URL: https://github.com/apache/airflow/pull/67620#issuecomment-4763585102
> Also we should probably not reference airflow-s issue from here. (more of the opposite way, reference this from airflow-s, linking is both ways anyway and will prevent people from searching for such airflow-s referencing issues) True. I removed it from the SKILL already. > Code and PR description are not in line. > If user isn't authorized to read a variable, existing variable is just ignored from the test. Hmm. mot sure. Indeed that's how it is implemented (assuming variable - connection :). The root of the problem here is however, that "require_access_connection" only uses connection parameter - but not body-specified connection_id. So no matter if the connection belongs to a team or not, with POST the user with test connection could just "run" and allow to enumerate the connections that otherwise they would not be able to know even exist. This is "defense-in-depth" - so nothing serious but still worth checking I guess. I think the description is pretty accurate. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
