Vamsi-klu commented on PR #69998: URL: https://github.com/apache/airflow/pull/69998#issuecomment-5014062857
I rechecked the current head and think the repair path needs a security/compatibility redesign before it is safe to validate against a real workspace: - `GET` should render a read-only confirmation page; only a CSRF-protected, Dag-authorized `POST` should repair or clear tasks. - The URL should carry only validated Dag/run/task identifiers. `databricks_conn_id`, the Databricks run ID, and Databricks task keys should be derived server-side from trusted `WorkflowRunMetadata` XCom instead of accepted from the request. - Redirect targets should be same-site relative paths built from validated identifiers, resolving the two open CodeQL redirect findings. - The FastAPI repair app should be registered only on Airflow 3.1+, since `resolve_user_from_token` is unavailable on 3.0.6. Provider config must come from `airflow.providers.common.compat.sdk`, not `airflow.configuration`, to clear the current static check. - Databricks failures should produce a generic 502 without reflecting raw upstream exception text, and task clearing should happen only after a successful repair call. - Confirmation-page values must be safely encoded so identifiers cannot become reflected HTML or JavaScript. The PR body should also include `related: #52280`. I can prepare a patch branch with the route split, trusted identifier resolution, access checks, and focused DB/API tests if that collaboration route would be useful; I will not open a competing Apache PR while this one is active. Until the mutation-on-GET issue is fixed, I do not recommend clicking the current repair link against a live Databricks workspace. --- Drafted-by: Codex (GPT-5) (no human review before posting) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
