pierrejeambrun commented on code in PR #72640:
URL: https://github.com/apache/airflow/pull/72640#discussion_r3951288613
##########
airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_partitioned_dag_runs.py:
##########
@@ -301,6 +301,29 @@ def
test_partitioned_dag_runs_filters_unreadable_dags(self, _, test_client, dag_
dag_ids = {r["dag_id"] for r in body["partitioned_dag_runs"]}
assert "restricted_dag" not in dag_ids
+ @mock.patch(
+
"airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager.get_authorized_dag_ids",
+ return_value={"other_dag"},
+ )
+ def test_dag_id_filter_does_not_disclose_unreadable_dag_existence(
+ self, _, test_client, dag_maker, session
+ ):
+ """
+ An unreadable-but-existing Dag must not be distinguishable from a
nonexistent
+ Dag via the ``dag_id`` filter: both return 404. Without the scoped
existence
+ probe, the existing Dag returned 200-empty while the nonexistent one
returned
+ 404, giving the caller an oracle for Dag ids outside their permitted
set.
+ """
+ schedule = PartitionedAssetTimetable(assets=Asset(uri="s3://bucket/a",
name="a"))
+ with dag_maker(dag_id="restricted_dag", schedule=schedule,
serialized=True):
+ EmptyOperator(task_id="t")
+ dag_maker.sync_dagbag_to_db()
+ session.commit()
Review Comment:
Done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
