You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2023/07/05 05:51:48 UTC
[GitHub] [airflow] potiuk opened a new issue, #32360: Consider changing API to not use regexp pattern
potiuk opened a new issue, #32360:
URL: https://github.com/apache/airflow/issues/32360
### Body
Our public REST API specification has the possibility of using regexp pattern (dag_id_pattern). This is potentially dangerous as free regexp patterns might have potentially some problems (like infinite recursion or non-linear performance of some patterns) and regexp parsing libraries might have unknown bugs, We should consider making a backwards-incompatible release of the API with the pattern feature removed.
This wouls be a breaking change, and breaking the promise we made to keep our Stable REST API the most stable part of the [Public Airflow Interface](https://airflow.apache.org/docs/apache-airflow/stable/public-airflow-interface.html) that we promised our users to rely on, so should carefully consider if removing it is worth breaking the promise. It would also require strong justification and unsolvable security/performance issue to make such change without bumping the REST API version to new MAJOR version and it would disconnect Airflow MAJOR version from the API MAJOR version, so likely the only good time we can do it, is when we release Airflow 3.
### Committer
- [X] I acknowledge that I am a maintainer/committer of the Apache Airflow project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Consider changing API to not use regexp pattern [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed issue #32360: Consider changing API to not use regexp pattern
URL: https://github.com/apache/airflow/issues/32360
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #32360: Consider changing API to not use regexp pattern
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #32360:
URL: https://github.com/apache/airflow/issues/32360#issuecomment-1621068823
cc: @bolkedebruin
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Consider changing API to not use regexp pattern [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on issue #32360:
URL: https://github.com/apache/airflow/issues/32360#issuecomment-2410314978
I just saw the Pull request associated to this and it makes me wonder. The actual `dag_id_pattern` is not used to do regexp matching, but db `ilike` macthing which does not leverage the standard regexp engine matcher but its own thing which is safer.
For instance for postgres some informations are available here https://www.postgresql.org/docs/current/functions-matching.html#FUNCTIONS-LIKE, and as mentioned in the note just above seems safer from a security point of view. In opposition the paragraph right after highlights the `similar to regular expression` syntax, which is vulnerable.
I am second guessing if we need to do something here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] pierrejeambrun commented on issue #32360: Consider changing API to not use regexp pattern
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on issue #32360:
URL: https://github.com/apache/airflow/issues/32360#issuecomment-1622169257
Nice, thanks for opening :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Consider changing API to not use regexp pattern [airflow]
Posted by "Bowrna (via GitHub)" <gi...@apache.org>.
Bowrna commented on issue #32360:
URL: https://github.com/apache/airflow/issues/32360#issuecomment-2230065431
@kaxil @potiuk Can i take a look into this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Consider changing API to not use regexp pattern [airflow]
Posted by "Bowrna (via GitHub)" <gi...@apache.org>.
Bowrna commented on issue #32360:
URL: https://github.com/apache/airflow/issues/32360#issuecomment-2293038853
@kaxil I will raise my PR before this weekends
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Consider changing API to not use regexp pattern [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #32360:
URL: https://github.com/apache/airflow/issues/32360#issuecomment-2412595905
You are very right @pierrejeambrun ! We can close it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Consider changing API to not use regexp pattern [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil commented on issue #32360:
URL: https://github.com/apache/airflow/issues/32360#issuecomment-2292547607
@Bowrna This is now assigned to you :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org