starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-23 08:03:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

[ee] fix: stop handlers, apps and agents resolving untrusted refs (#11893)

Browse Source 
* fix: stop handler, app and agent jobs resolving untrusted references

* perf: skip decoding untrusted args that hold no dollar or escape

* test: drop the transaction the recovery handler no longer takes

* fix: flag reserved names in object keys and tighten the jsonb parity test
This commit is contained in:
AlexRV12
2026-10-21 10:19:20 +02:00
committed by GitHub
parent f400d520d6
commit eda610b2f4
8 changed files with 627 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-queue/src/jobs.rs
+9 -2
View File
@@ -54,6 +54,7 @@ use windmill_common::runnable_settings::{
};
use windmill_common::triggers::TriggerMetadata;
use windmill_common::utils::{calculate_hash, configure_client, now_from_db, strip_json_nul};
use windmill_common::variables::omit_untrusted_interpolation;
use windmill_common::worker::Connection;
use windmill_common::otel_oss::{
@@ -3688,10 +3689,16 @@ pub async fn push_success_handler<'a, 'c, T: Serialize + Send + Sync>(
return Ok(uuid);
}
/// A handler's args from the job's result, which the job's author controls while the handler
/// runs as its own identity.
fn sanitize_result<T: Serialize + Send + Sync>(result: Json<&T>) -> HashMap<String, Box<RawValue>> {
let as_str = serde_json::to_string(result.0).unwrap_or_else(|_| "{}".to_string());
serde_json::from_str::<HashMap<String, Box<RawValue>>>(&as_str)
.unwrap_or_else(|_| [("error".to_string(), RawValue::from_string(as_str).unwrap())].into())
let args = serde_json::from_str::<HashMap<String, Box<RawValue>>>(&as_str)
.unwrap_or_else(|_| [("error".to_string(), RawValue::from_string(as_str).unwrap())].into());
omit_untrusted_interpolation(
args,
"The following resource has been omitted for security reasons: ",
)
}
// #[derive(Serialize)]