hussein-awala commented on code in PR #64610:
URL: https://github.com/apache/airflow/pull/64610#discussion_r3566426825
##########
airflow-core/src/airflow/api_fastapi/common/parameters.py:
##########
@@ -1639,6 +1695,13 @@ def _transform_ti_states(states: list[str] | None) ->
list[TaskInstanceState | N
QueryAssetAliasNamePrefixPatternSearch = Annotated[
_PrefixSearchParam,
Depends(prefix_search_param_factory(AssetAliasModel.name,
"name_prefix_pattern"))
]
+QueryAssetEventPartitionKeyFilter = Annotated[
+ FilterParam[str | None],
+ Depends(filter_param_factory(AssetEvent.partition_key, str | None,
filter_name="partition_key")),
+]
+QueryAssetEventPartitionKeyRegex = Annotated[
+ _RegexParam, Depends(regex_param_factory(AssetEvent.partition_key,
"partition_key_regexp_pattern"))
+]
Review Comment:
Thanks -- I went with your first suggestion and moved the timeout into the
filter's dependency itself.
`regex_param_factory` now returns a `yield` dependency that takes the
request session and wraps the query in `apply_regex_query_timeout(...)`
whenever a pattern is supplied. So any endpoint that uses
`QueryAssetEventPartitionKeyRegex` gets the DB-side timeout applied
automatically -- there's nothing left for a view to forget, which removes the
CVE-by-omission risk you flagged. I dropped the manual
`apply_regex_query_timeout` wrappers from the core and execution asset-event
routes accordingly.
One detail: the dependency is declared `scope="function"` so it can depend
on the (function-scoped) `SessionDep` it bounds; the session is still shared
with the endpoint, and the previous `statement_timeout` / `max_execution_time`
is restored on teardown. Added unit tests covering that the timeout is applied
when a pattern is given, skipped when it isn't, and that disabled/invalid
patterns still return 400.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
