pierrejeambrun commented on code in PR #45393: URL: https://github.com/apache/airflow/pull/45393#discussion_r1905499165
########## airflow/api_fastapi/core_api/routes/public/dag_report.py: ########## @@ -0,0 +1,49 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +from __future__ import annotations + +from airflow.api_fastapi.common.router import AirflowRouter +from airflow.api_fastapi.core_api.datamodels.dag_report import ( + DagReportCollectionResponse, + DagReportResponse, +) +from airflow.models.dagbag import DagBag +from airflow.utils.cli import process_subdir + +dag_report_router = AirflowRouter(tags=["DagReport"], prefix="/dagReport") + + +@dag_report_router.get( + "", +) +def get_dag_report( + subdir: str, Review Comment: Do we need the `subdir` granularity ? Otherwise in the fastapi application we already have access to the DagBag that is built based on `DAGS_FOLDER` coming from the configuration file. (`request.app.state.dag_bag`) Also that feels sensitive, because we will be manipulating a user provided path on the server... (for instance provide a path to a really big folder, or something with a lot of zipped archives, such as logs, and the server will spend a lot of time doing unnecessary work => DOS) ########## airflow/api_fastapi/core_api/routes/public/dag_report.py: ########## @@ -0,0 +1,49 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +from __future__ import annotations + +from airflow.api_fastapi.common.router import AirflowRouter +from airflow.api_fastapi.core_api.datamodels.dag_report import ( + DagReportCollectionResponse, + DagReportResponse, +) +from airflow.models.dagbag import DagBag +from airflow.utils.cli import process_subdir + +dag_report_router = AirflowRouter(tags=["DagReport"], prefix="/dagReport") Review Comment: ```suggestion dag_report_router = AirflowRouter(tags=["DagReport"], prefix="/dagReports") ``` ########## airflow/api_fastapi/core_api/routes/public/dag_report.py: ########## @@ -0,0 +1,49 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +from __future__ import annotations + +from airflow.api_fastapi.common.router import AirflowRouter +from airflow.api_fastapi.core_api.datamodels.dag_report import ( + DagReportCollectionResponse, + DagReportResponse, +) +from airflow.models.dagbag import DagBag +from airflow.utils.cli import process_subdir + +dag_report_router = AirflowRouter(tags=["DagReport"], prefix="/dagReport") + + +@dag_report_router.get( + "", +) +def get_dag_report( + subdir: str, +): + """Get DAG report.""" + # though the `subdir` will be validated on CLI side, we still need to validate again here or the CodeQL will report a security issue + dagbag = DagBag(process_subdir(subdir)) Review Comment: I think we can remove the comment. From the API point of view this is just another public endpoint. And some roles / permissions will be applied, but we do not code this assuming that only a specific role will have access. (Also at the moment everybody has access), so validating again on the API side is always required. ########## airflow/api_fastapi/core_api/routes/public/dag_report.py: ########## @@ -0,0 +1,49 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +from __future__ import annotations + +from airflow.api_fastapi.common.router import AirflowRouter +from airflow.api_fastapi.core_api.datamodels.dag_report import ( + DagReportCollectionResponse, + DagReportResponse, +) +from airflow.models.dagbag import DagBag +from airflow.utils.cli import process_subdir + +dag_report_router = AirflowRouter(tags=["DagReport"], prefix="/dagReport") + + +@dag_report_router.get( + "", +) +def get_dag_report( + subdir: str, Review Comment: Or at least we need to check that the provided path is a subpath of `DAGS_FOLDER` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
