SEZ9 commented on PR #11734: URL: https://github.com/apache/seatunnel/pull/11734#issuecomment-6096343121
Thanks for the detailed pointer back to the document at `a986eb165c`. If the `## Security and Input Validation` and `## REST Contract` sections contain the prose you describe — the `BasicAuthFilter` inheritance and shared-credential caveat, best-effort redaction before every write to the running map or finished snapshot, no storage or exposure of worker `host:port`, and the URI/`limit` grammar with `400`/`404` rules plus R5 — then that would cover the substance of PR11734-F1 through F4, and my earlier re-read focusing only on R1-R5 missed it. Apologies for the churn. Before I close these out, could you quote the relevant passages from the changed file at that head (or link the diff lines)? The thread so far only summarizes them, and I'd like to confirm against the document itself, particularly for F1 given its severity. One non-blocking suggestion to make this harder to miss in future rounds: fold the Security paragraphs into a table with the same writer / enforcement-point / fence shape as R1-R5, and either extend R5 or add a sibling table for the `limit`/path grammar, so all normative content lives in one place. Happy for that to be a follow-up if you prefer. <!-- streview-comment:1648 --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
