weiqingy commented on code in PR #1005:
URL: https://github.com/apache/flink-agents/pull/1005#discussion_r3911067878
##########
python/flink_agents/api/skills.py:
##########
@@ -57,13 +57,118 @@ def packaged_skills() -> Skills:
from __future__ import annotations
+import re
+from ipaddress import AddressValueError, IPv6Address
from typing import Dict, List, Tuple
+from urllib.parse import urlparse, urlsplit, urlunsplit
from pydantic import BaseModel, ConfigDict, Field, field_validator
from typing_extensions import override
from flink_agents.api.resource import ResourceType, SerializableResource
+_INVALID_URI_CHARACTER = re.compile(r'[\x00-\x20\x7f<>"{}|\\^`]')
+_INVALID_PERCENT_ESCAPE = re.compile(r"%(?![0-9a-fA-F]{2})")
+_HOST_LABEL = re.compile(r"[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?")
+
+
+def redact_skill_url(url: str) -> str:
+ """Return a skill URL without user info, query parameters, or a fragment.
+
+ Internal contract shared with the runtime; not a stable public API.
+ """
+ try:
+ parts = urlsplit(url)
+ if not parts.scheme or not parts.netloc:
+ return "<redacted>"
+ netloc = parts.netloc.rsplit("@", 1)[-1]
+ if not netloc:
+ return "<redacted>"
+ return urlunsplit((parts.scheme, netloc, parts.path, "", ""))
Review Comment:
nit: `redact_skill_url` still lets a raw control character through, while
the new Java guard now blocks it.
`https://u:[email protected]/a\x1b[31mred?token=SECRET`:
- Java: `Invalid skill URL: <redacted>`
- Python: `Invalid skill URL: https://example.com/a\x1b[31mred`
Small either way. Neither side leaks the password or the token, and CR/LF
cannot get through on Python because `urlsplit` strips them first. So it is an
ANSI escape in an exception message, not log line forging.
The Java half is `containsUnsafeLogCharacter` (`SkillUrlUtils.java:133`),
pinned by `SkillsResourceTest.java:144`. Worth mirroring here, or is the
Java-only guard deliberate?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
