potiuk opened a new pull request, #74834:
URL: https://github.com/apache/airflow/pull/74834
XCom values and Human-in-the-loop `params_input` already reject keys
reserved by the
serialization format (`__classname__`, `__version__`, `__data__`,
`__cache__`, and the
legacy `__type`, `__source`, `__var`). Dag run `conf` did not, although it
is passed on to
code that decodes serialized values, for example the context of a Deadline
Alert callback.
A conf value that happens to look like serialized data should reach that
code as the dict
that was submitted, or be rejected up front, never be decoded as something
else.
This applies the XCom check to conf where it enters through the REST API:
- `POST /dags/{dag_id}/dagRuns` (`TriggerDAGRunPostBody`), also used by the
UI trigger form
- `POST /assets/{asset_id}/materialize` (`MaterializeAssetBody` inherits the
validator)
- `POST /backfills` and `POST /backfills/dry_run` (`dag_run_conf`)
Nested values and JSON-string values are checked, as for XCom, and such a
payload gets a 422
naming the path of the offending mapping.
`Deadline.handle_miss` also refuses to queue a triggerer callback whose
context holds reserved
keys in either encoding, the same way strict `serialize` already refuses
`__classname__`. This
covers conf stored before this change, and conf set by Dag code through the
Execution API,
whose trigger route is left unchanged like Execution API XCom writes.
Tests cover each entry point with current, legacy, nested and JSON-string
payloads, normal
conf still being accepted, and the Deadline context never being decoded.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Opus 5 following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License
Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment:
`{pr_number}.significant.rst`, in
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
You can add this file in a follow-up commit after the PR is created so you
know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
