You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2022/05/24 08:04:08 UTC

[GitHub] [airflow] cuu508 opened a new issue, #23882: Outdated croniter dependency

cuu508 opened a new issue, #23882:
URL: https://github.com/apache/airflow/issues/23882

   ### Apache Airflow version
   
   2.3.0 (latest released)
   
   ### What happened
   
   setup.cfg contains 
   
       croniter>=0.3.17
   
   croniter versions before 1.0.5 have a security issue: if you pass expressions
   like "0-1000000000 * * * *" to it, croniter can throw an exception, or
   take a long time to return, or crash the python process.
   
   
   ### What you think should happen instead
   
   It would be a good idea to tighten up the croniter dependency and require at least version 1.0.5. 
   
   ### How to reproduce
   
   _No response_
   
   ### Operating System
   
   N/A
   
   ### Versions of Apache Airflow Providers
   
   _No response_
   
   ### Deployment
   
   Other
   
   ### Deployment details
   
   _No response_
   
   ### Anything else
   
   _No response_
   
   ### Are you willing to submit PR?
   
   - [ ] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [airflow] potiuk closed issue #23882: Outdated croniter dependency

Posted by GitBox <gi...@apache.org>.
potiuk closed issue #23882: Outdated croniter dependency
URL: https://github.com/apache/airflow/issues/23882


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [airflow] eladkal commented on issue #23882: Outdated croniter dependency

Posted by GitBox <gi...@apache.org>.
eladkal commented on issue #23882:
URL: https://github.com/apache/airflow/issues/23882#issuecomment-1135666113

   Airflow is recommended to be installed with [constraints](https://airflow.apache.org/docs/apache-airflow/stable/installation/installing-from-pypi.html#installation-tools)
   
   If you follow the guidelines and check the constraints file you will see:
   https://github.com/apache/airflow/blob/d18aee02142e0ab285101c45c60de1c81ef7e7ad/constraints-3.7.txt#L206
   
   I have no objection for setting higher lower bound but for the end user who follow documentation this is not an issue.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [airflow] uranusjr commented on issue #23882: Outdated croniter dependency

Posted by GitBox <gi...@apache.org>.
uranusjr commented on issue #23882:
URL: https://github.com/apache/airflow/issues/23882#issuecomment-1136812195

   IMO Airflow should not be eagerly determining what version of a package should be used here. Any croniter versions newer than 0.3.17 is compatible, and that’s what Airflow’s dependency metadata should care about.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [airflow] boring-cyborg[bot] commented on issue #23882: Outdated croniter dependency

Posted by GitBox <gi...@apache.org>.
boring-cyborg[bot] commented on issue #23882:
URL: https://github.com/apache/airflow/issues/23882#issuecomment-1135543060

   Thanks for opening your first issue here! Be sure to follow the issue template!
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [airflow] potiuk commented on issue #23882: Outdated croniter dependency

Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #23882:
URL: https://github.com/apache/airflow/issues/23882#issuecomment-1136918516

   We can add lower-bound limitations - and we did it for some really serious security issues when we wanted to make sure that our users did not use certain dependencies (or where we new there is a compatibility issue. But in this case, where DAG writer can anyhow do whatever (including spawning millions of processes or allocating all memory or deleting the whole database, the fact that they can also write a potentialy crashing cron expression, is basically no issue.
   Closing.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org