rfellows commented on code in PR #11773:
URL: https://github.com/apache/nifi/pull/11773#discussion_r4231318434
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/canvas/canvas.component.ts:
##########
@@ -1756,8 +2039,10 @@ export class CanvasComponent implements OnInit,
AfterViewInit, OnDestroy {
// Emit to parent for server save
this.labelResizeEnd.emit({
id: labelId,
- dimensions: event.dimensions
+ dimensions: event.dimensions,
+ revision: event.label.ui.dragStartRevision ??
event.label.entity.revision
Review Comment:
Must fix: this output is declared with a `RevisionRequest`, but it forwards
a read-side `Revision` object directly. If the server revision contains
`lastModifier`, TypeScript structural typing allows the assignment but does not
remove that property at runtime, so server-only revision fields can escape
through the request boundary. The same pattern appears in the bend,
label-index, and reconnect outputs. Could every emitted revision be projected
into a fresh request object containing only the permitted `version` and
`clientId` fields, with a regression test seeded with `lastModifier` that
asserts it is absent?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
