The GitHub Actions job "Tests (AMD)" on 
airflow.git/resolve-team-namespaced-env-secret-only-for-its-team has succeeded.
Run started by GitHub user potiuk (triggered by potiuk).

Head commit for run:
fe40bf22be2f0ac3bcff8359014a39b7a231c3bb / Jarek Potiuk <[email protected]>
Refuse a team namespaced id for the team agnostic lookup outright

The previous guard compared the supplied id against the namespace prefix the
caller's own team builds, and treated a match as proof the id was the caller's
own. It is not. A team name may itself contain the `___` separator, so one
team's namespace can start with another's: for a caller in team `a`, the id
`_a___b___c` starts with `_A___`, but the variable it resolves,
`AIRFLOW_CONN__A___B___C`, belongs to team `a___b`. The prefix cleared the
guard, the team scoped lookup missed, and the team agnostic lookup returned the
other team's secret -- the same cross-team read the guard exists to stop, for
every team whose name extends the caller's.

Drop the attribution attempt. The team scoped lookup runs first and is safe by
construction, since it can only ever build the caller's own namespace. After it
misses, an id that spells out any team namespace is refused, because the team
agnostic lookup would land inside one. The id is never parsed to decide which
team it belongs to -- that question has no answer.

A caller reaching its own team's secret through the namespaced spelling rather
than the bare id plus its team scope is no longer resolved. That spelling is
what made a prefix match look like ownership.

Report URL: https://github.com/apache/airflow/actions/runs/30560706148

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to