ryankert01 opened a new pull request, #4083:
URL: https://github.com/apache/iggy/pull/4083
## Which issue does this PR address?
Closes #4058
## Rationale
The `{key}` path parameter of the connectors control API reached a
filesystem path unvalidated; the issue explains why the missing exploit is an
accident of the filename prefix.
## What changed?
`POST /{sinks,sources}/{key}/configs` spliced the `{key}` segment straight
into `config_dir/{sink,source}_{key}_{version}.toml`; only the literal
`sink_`/`source_` prefix kept `..` from escaping.
Every `{key}` route now parses the segment into a `ConnectorKey` (at most
128 bytes of `[A-Za-z0-9._-]`, leading alphanumeric so `.`, `..` and hidden
names are impossible) through a small extractor that answers with the API's
usual `400 {"code": "invalid_connector_key"}` body, and the provider `create_*`
methods take the parsed type so the write site cannot see a raw string. Keys
loaded from TOML or the HTTP provider are not rejected, since that would stop
running deployments; the runtime warns at startup about any key it cannot
address.
## Local Execution
- Passed: `cargo clippy --all-targets -- -D warnings` on `iggy-connectors`
and `integration`, `cargo test -p iggy-connectors`, `cargo test -p integration
-- connectors::api::
connectors::runtime::error_isolation::source_with_invalid_state`, markdownlint,
typos
- Pre-commit hooks not ran (`prek` not installed on this machine); the
checks above were run by hand
## AI Usage
- Tools: Claude Code (Claude Fable 5.1).
- Scope: drafted the implementation, tests and README changes, then ran a
four-reviewer adversarial review whose confirmed findings were folded in.
- Verification: the local runs listed above, plus a verbose run confirming
the startup warning fires for the in-tree slash-key fixture.
- Yes, I can explain every line.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
