The GitHub Actions job "Tests (AMD)" on airflow.git/databricks-repair-from-airflow-3 has succeeded. Run started by GitHub user PrakshiGoyal10 (triggered by eladkal).
Head commit for run: 5e536ea90beacc1c02d3023d16fbf256731147c9 / PrakshiGoyal10 <[email protected]> Harden Airflow 3 Databricks repair endpoint against CSRF and open redirect The repair action mutated state on a cookie-authenticated GET and trusted the Databricks connection, run id, and task keys from the request, so a crafted repair link could repair an arbitrary run and CodeQL flagged the redirect as an open redirect. The endpoint also required an auth helper unavailable on 3.0.6. A GET now renders a read-only confirmation page and only a same-site POST repairs and clears tasks, which SameSite=Lax on the auth cookie protects from cross-site forgery. The connection and Databricks run id are derived server-side from the launch task's trusted WorkflowRunMetadata XCom, the redirect target is a same-site relative path, Databricks failures return a generic 502, and the backend is gated to Airflow 3.1+ where its authentication resolver exists. Report URL: https://github.com/apache/airflow/actions/runs/31011670850 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
