The GitHub Actions job "Tests (AMD)" on airflow.git/resolve-team-namespaced-env-secret-only-for-its-team has succeeded. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: fe40bf22be2f0ac3bcff8359014a39b7a231c3bb / Jarek Potiuk <[email protected]> Refuse a team namespaced id for the team agnostic lookup outright The previous guard compared the supplied id against the namespace prefix the caller's own team builds, and treated a match as proof the id was the caller's own. It is not. A team name may itself contain the `___` separator, so one team's namespace can start with another's: for a caller in team `a`, the id `_a___b___c` starts with `_A___`, but the variable it resolves, `AIRFLOW_CONN__A___B___C`, belongs to team `a___b`. The prefix cleared the guard, the team scoped lookup missed, and the team agnostic lookup returned the other team's secret -- the same cross-team read the guard exists to stop, for every team whose name extends the caller's. Drop the attribution attempt. The team scoped lookup runs first and is safe by construction, since it can only ever build the caller's own namespace. After it misses, an id that spells out any team namespace is refused, because the team agnostic lookup would land inside one. The id is never parsed to decide which team it belongs to -- that question has no answer. A caller reaching its own team's secret through the namespaced spelling rather than the bare id plus its team scope is no longer resolved. That spelling is what made a prefix match look like ownership. Report URL: https://github.com/apache/airflow/actions/runs/30560706148 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
