kunwp1 commented on code in PR #6866: URL: https://github.com/apache/texera/pull/6866#discussion_r3780247728
########## bin/mounter/mounter.py: ########## Review Comment: > Regarding path, computing unit name is "computing-unit-" which has no `..` and version is hex digest which also don't have `..` so path will be always correct. Your claim assumes if it's only passed by trusted caller. Authenticated user can still for example write a python UDF with POST /mount code and pass weird values for repo name and commit hash. For security reasons, better to sanitize what the user sends. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
