From 568d9cc8a086178314e15e3c27fb55ff4817f5cd Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Thu, 30 Apr 2026 13:53:50 +0000 Subject: [PATCH] fix: sanitize underscores in agent worker suffix (#8992) * fix: sanitize underscores in agent worker suffix The agent worker token wire format is `jwt_agent__`, parsed server-side with `split_once('_')`. JWTs themselves can contain `_` (base64url alphabet), so the only sound boundary is "suffix has no `_`". `instance_name()` is the source of the suffix and previously only sanitized spaces and `-`. A hostname like `austin_hp` would produce `worker_suffix=austin_hp-`, the token `jwt_agent_austin_hp-X_` would split as `("austin", "hp-X_")`, and the JWT decoder would return `InvalidToken` on the garbage second half, surfacing as a 401 on `/api/agent_workers/update_ping`. Replace `_` with `-` in the hostname-derived suffix so the parsing boundary stays unambiguous. Pure source-side fix; no wire format change, no migration needed. Co-Authored-By: Claude Opus 4.7 (1M context) * fix: apply underscore->dash before splitting in instance_name Replace `_` with `-` BEFORE the `split("-").last()` step so underscores behave the same as dashes (consistent with the split-on-dash idiom) and the resulting instance_name is a single token. For `austin_hp` this yields `hp` rather than `austin-hp`. No behavior change for hostnames without `_`. Co-Authored-By: Claude Opus 4.7 (1M context) * fix: strip underscores from hostname instead of replacing with dash Removing `_` preserves more identifier info than replacing with `-`: `austin_hp` becomes `austinhp` (single useful token) rather than `hp` (prefix lost to the dash-split). For k8s-style hostnames that already contain `-`, the `-` continues to do the splitting and `_` is just a stray character to strip. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- backend/windmill-common/src/utils.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs index 52958aedb9..efe5481e1d 100644 --- a/backend/windmill-common/src/utils.rs +++ b/backend/windmill-common/src/utils.rs @@ -259,11 +259,11 @@ pub async fn require_admin_or_devops( fn instance_name(hostname: &str) -> String { hostname .replace(" ", "") + .replace('_', "") .split("-") .last() .unwrap() .to_ascii_lowercase() - .to_string() } const DEFAULT_WORKER_SUFFIX_LEN: usize = 5;