potiuk commented on code in PR #70889:
URL: https://github.com/apache/airflow/pull/70889#discussion_r3711264704
##########
airflow-core/tests/unit/api_fastapi/core_api/test_security.py:
##########
@@ -430,7 +433,10 @@ async def test_requires_access_backfill_unauthorized(self,
mock_get_auth_manager
async def
test_requires_access_backfill_backfill_not_found_falls_back_to_body(
self, mock_get_auth_manager, mock_get_team_name
):
- """When backfill_id is int but Backfill not found, dag_id from body is
used."""
+ """When backfill_id is int but Backfill not found, dag_id from body is
used.
+
+ Not exploitable: the handler answers 404 before acting, so no
cross-Dag action follows.
+ """
Review Comment:
I will open an issue for it and leave link in TODO here. Planned to do it
after :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
