[GitHub] [airflow] mik-laj edited a comment on issue #8279: Protect /rendered page from invalid DAG ids (#8171)

[GitBox <gi...@apache.org>]

mik-laj edited a comment on issue #8279: Protect /rendered page from invalid DAG ids (#8171)
URL: https://github.com/apache/airflow/pull/8279#issuecomment-613732733
 
 
   I open following page:
   ```
   http://localhost:28080/rendered?dag_id=example_bash_operator&task_id=runme_0&execution_date=2020-04-13T00%3A00%3A00%2B00%3A00
   ```
   I see the correct view.
   I add one letter to the task ID.
   ```
   http://localhost:28080/rendered?dag_id=example_bash_operator&task_id=runme_0D&execution_date=2020-04-13T00%3A00%3A00%2B00%3A00
   ```
   ![Screenshot 2020-04-15 at 01 26 50](https://user-images.githubusercontent.com/12058428/79283461-38c8fe00-7eb8-11ea-8fe0-0f142641c8e0.png)
   I see a mushroom. This should not happen in a mature application. A clear error message should appear.
   
   When I open following address:
   ```
   http://localhost:28080/rendered?dag_id=example_bash_operator&task_id=runme_0&execution_date=2020-04-13T00%3A00%3A00%2B00%3A00DDDD
   ```
   I also see mushroom.
   ![Screenshot 2020-04-15 at 01 29 02](https://user-images.githubusercontent.com/12058428/79283552-86de0180-7eb8-11ea-9f9c-e835869d20f0.png)
   This is a user-experience problem, but it is also a security problem.  If we see similar messages, it means that we haven't verified enough input data. Data validation is the basic method of protecting against other serious attacks from the "Injection" family e.g. SQL Injection. Input validation should happen as early as possible in the data flow, preferably as soon as the data is received from the client.  However, we do not have any validation for many parameters.
   ![image](https://user-images.githubusercontent.com/12058428/79283676-d58b9b80-7eb8-11ea-8514-c3abd89e3416.png)
   
   More information:
   https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
   
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services