potiuk commented on issue #23: URL: https://github.com/apache/tooling-agents/issues/23#issuecomment-4681268323
Thanks @andrewmusselman — triage of the L3/opus-4.8 `cc63c83` scan (31 findings) against current `main` below. ## Fixing in this round (public PR) | # | Finding | PR | |---|---|---| | **FINDING-003** | `DagErrorHandler` returns the raw deserialization-error text in the HTTP 500 `detail` regardless of `api.expose_stacktrace`, unlike its sibling `_UniqueConstraintErrorHandler` | [apache/airflow#68388](https://github.com/apache/airflow/pull/68388) — gate the raw text behind `expose_stacktrace` + log server-side with a correlation id (also resolves **FINDING-029**, which raised without server-side logging) | ## Already addressed by prior-round work - **FINDING-014** (`FilterParam` CONTAINS doesn't escape LIKE wildcards) → [apache/airflow#67496](https://github.com/apache/airflow/pull/67496). - **FINDING-013** (query string unredacted in the access log) → covered by the prior round's HTTP-access-log redaction work; the default JSON renderer also escapes the control characters this depends on. ## By design / out of scope per the [Security Model](https://github.com/apache/airflow/blob/main/airflow-core/docs/security/security_model.rst) - **FINDING-004** — the four Execution API read endpoints (`/count`, `/previous`, `/states`, `/breadcrumbs`) are intentionally unauthenticated: the Execution API is an internal worker↔scheduler surface, and cross-task reads there are by design. - **FINDING-001** — Core/Execution API audience sharing: Execution-API tokens are short-lived and per-task ([jwt doc](https://github.com/apache/airflow/blob/main/airflow-core/docs/security/jwt_token_authentication.rst)); the surface is network-isolated, so distinct audiences would be deployment-isolated defense-in-depth, not a model violation. - **FINDING-005 / 006 / 008 / 009 / 010 / 011** — token-revocation / session-timeout / refresh semantics → external IdP / short-lived-JWT responsibility. - **FINDING-007** — login timing channel on `SimpleAuthManager`, which is dev-only. - **FINDING-015** — `conn_type` validation: connection configuration is a trusted action. - **FINDING-019 / 020 / 021 / 022** — cookie `__Host-`/`__Secure-` prefixes, conditional `Secure`, cookie length: deployment-manager / reverse-proxy responsibility (the default config already sets `Secure` on HTTPS, and the `__Host-` defense only matters against an attacker-controlled sibling subdomain). - **FINDING-018 / 027** — `correlation-id` header/log handling: CR/LF **header** injection is rejected by uvicorn/`h11` before it reaches the wire (same mitigation as the WSGI request-smuggling finding), and **log** injection is mitigated by the default JSON renderer, which escapes control characters. - **FINDING-016** — client-supplied tracing headers echoed: self-reflected to the same caller, server-layer safe. - **FINDING-025 / 026** — access log omits principal / relies on external timestamp processor: audit-log-schema improvements → docs, not security bugs. - **FINDING-017 / 028** — Content-Length/body and unique-constraint error-handler correctness nits. - **FINDING-023 / 024** — UI TypeScript code quality (`as JSON` assertion, object-literals vs `Map`/`Set`). - **FINDING-030** — individually-scoped dependency supply-chain surface → per the [3rd-party-dependency policy](https://github.com/apache/airflow/blob/main/airflow-core/docs/security/vulnerabilities-in-3rd-party-dependencies.rst). - **FINDING-031** — TOCTOU on a latest-log symlink: a local race on a worker host, which the model treats as operator-trusted. ## Handled by the security team - **FINDING-012** (event-log filter returns `dag_id IS NULL` audit rows) is being folded into existing security-team work; no separate public action here. --- This response was generated by AI and reviewed by @potiuk before posting; a human maintainer will follow up on anything that needs a closer look. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
