[GitHub] [airflow] mik-laj commented on issue #8171: Handle missing object in webserver

2020-04-14 Thread GitBox 
mik-laj commented on issue #8171: Handle missing object in webserver
URL: https://github.com/apache/airflow/issues/8171#issuecomment-613733028
 
 
   This is a user experience problem, but it is also a security problem.  If we 
see similar messages, it means that we haven't verified enough input data. Data 
validation is the basic method of protecting against other serious attacks from 
the "Injection" family e.g. SQL Injection. Input validation should happen as 
early as possible in the data flow, preferably as soon as the data is received 
from the client.  However, we do not have any validation for many parameters.
   
![image](https://user-images.githubusercontent.com/12058428/79283676-d58b9b80-7eb8-11ea-8514-c3abd89e3416.png)
   More information:
   
https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html


This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services

[GitHub] [airflow] mik-laj commented on issue #8171: Handle missing object in webserver

2020-04-13 Thread GitBox 
mik-laj commented on issue #8171: Handle missing object in webserver
URL: https://github.com/apache/airflow/issues/8171#issuecomment-612943432
 
 
   For clarity. This contribution does not have to solve all problems in one 
PR. I will be happy even if one problem is solved. And another person will be 
able to create more changes and solve more problems.
   
   
   List of all routes
   
   ```
   Endpoint MethodsRule
   ---  -  
--
   Airflow.blocked  POST   /blocked
   Airflow.clearPOST   /clear
   Airflow.code GET/code
   Airflow.dag_details  GET/dag_details
   Airflow.dag_statsPOST   /dag_stats
   Airflow.dagrun_clear POST   /dagrun_clear
   Airflow.dagrun_failedPOST   /dagrun_failed
   Airflow.dagrun_success   POST   /dagrun_success
   Airflow.delete   POST   /delete
   Airflow.duration GET/duration
   Airflow.elasticsearchGET/elasticsearch
   Airflow.extra_links  GET/extra_links
   Airflow.failed   POST   /failed
   Airflow.ganttGET/gantt
   Airflow.get_logs_with_metadata   GET/get_logs_with_metadata
   Airflow.graphGET/graph
   Airflow.health   GET/health
   Airflow.indexGET/home
   Airflow.landing_timesGET/landing_times
   Airflow.last_dagruns POST   /last_dagruns
   Airflow.log  GET/log
   Airflow.paused   POST   /paused
   Airflow.refresh  POST   /refresh
   Airflow.rendered GET/rendered
   Airflow.run  POST   /run
   Airflow.success  POST   /success
   Airflow.task GET/task
   Airflow.task_instances   GET/object/task_instances
   Airflow.task_stats   POST   /task_stats
   Airflow.tree GET/tree
   Airflow.triesGET/tries
   Airflow.trigger  GET, POST  /trigger
   Airflow.xcom GET/xcom
   AuthDBView.login GET, POST  /login/
   AuthDBView.logoutGET/logout/
   ConfigurationView.conf   GET/configuration
   ConnectionModelView.action   GET, POST  
/connection/action//
   ConnectionModelView.action_post  POST   /connection/action_post
   ConnectionModelView.add  GET, POST  /connection/add
   ConnectionModelView.api  GET/connection/api
   ConnectionModelView.api_column_add   GET
/connection/api/column/add/
   ConnectionModelView.api_column_edit  GET
/connection/api/column/edit/
   ConnectionModelView.api_create   POST   /connection/api/create
   ConnectionModelView.api_delete   DELETE 
/connection/api/delete/
   ConnectionModelView.api_get  GET/connection/api/get/
   ConnectionModelView.api_read GET/connection/api/read
   ConnectionModelView.api_readvalues   GET
/connection/api/readvalues
   ConnectionModelView.api_update   PUT
/connection/api/update/
   ConnectionModelView.delete   GET, POST  /connection/delete/
   ConnectionModelView.download GET
/connection/download/
   ConnectionModelView.edit GET, POST  /connection/edit/
   ConnectionModelView.list GET/connection/list/
   ConnectionModelView.show GET/connection/show/
   DagModelView.action  GET, POST  
/dagmodel/action//
   DagModelView.action_post POST   /dagmodel/action_post
   DagModelView.add GET, POST  /dagmodel/add
   DagModelView.api GET/dagmodel/api
   DagModelView.api_column_add  GET
/dagmodel/api/column/add/
   DagModelView.api_column_edit GET
/dagmodel/api/column/edit/
   DagModelView.api_create  POST   /dagmodel/api/create
   DagModelView.api_delete  DELETE /dagmodel/api/delete/
   DagModelView.api_get GET/dagmodel/api/get/
   DagModelView.api_read

[GitHub] [airflow] mik-laj commented on issue #8171: Handle missing object in webserver

2020-04-13 Thread GitBox 
mik-laj commented on issue #8171: Handle missing object in webserver
URL: https://github.com/apache/airflow/issues/8171#issuecomment-612939805
 
 
   It should be something similar. The most important thing is that no 
mushrooms appear, but user-readable error messages.
   
   For example:
   When you enter following address:
   http://localhost:28080/tries?dag_id=example_automl_text_sentiment2=30
   
http://localhost:28080/landing_times?dag_id=example_automl_text_sentiment2=30
   http://localhost:28080/gantt?dag_id=example_automl_text_sentiment2
   http://localhost:28080/dag_details?dag_id=example_automl_text_sentiment2
   http://localhost:28080/code?dag_id=example_automl_text_sentiment2
   you will see error screen similar:
   ![Screenshot 2020-04-13 at 17 06 
35](https://user-images.githubusercontent.com/12058428/79131646-362bb300-7da9-11ea-8c68-67e0534226a5.png)
   
   However, if you go to the link:
   http://localhost:28080/tree?dag_id=example_automl_text_cls2
   you will see following error message:
   ![Screenshot 2020-04-13 at 17 08 
08](https://user-images.githubusercontent.com/12058428/79131740-64a98e00-7da9-11ea-8578-95c001e87b6e.png)
   
   This should be standardized and a clear message should always be displayed 
to the user.
   
   
   
   


This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services