Ruben FiszelandClaude Opus 4.8 0937fb66ca fix: bound the guest JWT length before verifying or caching ...

The auth cache keys on the bearer token, and verify_for_workspace decoded a
token of any length (its header for the JWKS kid, then the body) before
rejecting it, so an oversized token could be decoded unauthenticated and, if it
verified, cached at full size. Refuse a token longer than MAX_GUEST_JWT_LEN
(8 KiB) at the top of verify_for_workspace, before the key lookup or any
signature work. Also correct the MAX_JWKS_URL_LEN doc: the bound holds because
the save path validates the URL through fetch_jwks, not because cached_jwks
checks it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-04 16:27:01 +02:00

..

fixtures

fix: let operators use wmill.datatable() from within running jobs (#10931)

2026-09-03 08:43:52 +02:00

scripts

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

agent_workers.rs

fix: keep agent-worker server job-completed processor alive & self-healing (#10033)

2026-07-10 23:42:30 +02:00

app_anonymous_execution_mode.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

app_custom_path_cross_workspace.rs

fix: actionable error when a custom_path is taken by an app in another workspace (#9190)

2026-05-16 08:29:53 +00:00

app_guest_allowance.rs

docs: the workspace-scoped guest_activity delete moves an instance-wide count; assert the mint records the guest

2026-09-04 15:50:41 +02:00

app_guest_execution_mode.rs

fix: carry the guest JWT key across a workspace rename

2026-09-04 14:57:35 +02:00

app_guest_jwt_allowance.rs

fix: audit the first JWT entry across an IdP row; finish has_any_account; nits

2026-09-03 23:08:02 +02:00

app_guest_jwt_entry.rs

fix: bound the guest JWT length before verifying or caching

2026-09-04 16:27:01 +02:00

app_preview_auth.rs

fix: add apps:run to the token scope picker and confine path-scoped app tokens (#10428)

2026-07-31 11:38:05 +02:00

app_s3_onbehalf.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

asset_trigger_dispatch.rs

fix: expand AZURE_DEVOPS_TOKEN placeholder in backend git probes (#10677)

2026-08-13 11:06:55 +00:00

batch_rerun.rs

[ee] feat(backend): native script retry without one-step-flow wrapping (#9688)

2026-06-25 13:22:26 +00:00

bun_jobs.rs

fix: invalidate bun bundle cache on transitive relative-import changes (#9891)

2026-07-02 23:57:26 +02:00

capture_cross_workspace.rs

fix: scope capture deletion to the workspace in the request path (#10795)

2026-08-22 10:01:25 +00:00

ci_tests.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

datatable_migration_add_down.rs

feat(datatables): add a down migration from the migration viewer (#10812)

2026-08-24 22:36:32 +02:00

datatable_migrations_grants.rs

fix: surface the real postgres error when data table migrations fail (#10371)

2026-07-28 14:29:06 +02:00

debounce_e2e.rs

fix(debounce): never supersede a running debounce survivor (#9780)

2026-06-25 16:36:16 +00:00

dedicated_workers.rs

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

delete_after_secs.rs

feat: add scheduled job deletion with configurable retention period (#8753)

2026-04-08 04:15:28 +00:00

dependency_map.rs

fix: stop app updates from silently converting an app between raw and low-code (#10495)

2026-08-04 10:52:20 +02:00

drafts_nul.rs

fix(backend): strip NUL bytes from draft values on write (#9673)

2026-06-19 13:33:36 +00:00

end_user_email.rs

refactor: deprecate username_to_email in favor of WM_END_USER_EMAIL (#10429)

2026-07-31 11:47:58 +02:00

error_handler.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

flow_engine_parity.rs

feat(flows): opt-in to include the stopping step's result in early-stop errors (#9446)

2026-06-04 18:57:05 +00:00

folder_default_permissioned_as.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

fork_deployment_requests.rs

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

freshness_watchdog.rs

feat(pipelines): asset freshness — fresh/stale badge (CE) + watchdog (EE) (#9909)

2026-07-04 06:23:44 +02:00

inline_preview_auth.rs

fix: let operators use wmill.datatable() from within running jobs (#10931)

2026-09-03 08:43:52 +02:00

instance_config.rs

feat(git-sync): dedicated base url for GitHub webhook delivery (#10411)

2026-07-30 23:27:12 +02:00

job_payload.rs

feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)

2026-04-28 20:00:03 +00:00

jobs_read_auth.rs

fix: confine jobs:run tokens to the jobs of the runnables they may start (#10635)

2026-08-14 18:57:57 +02:00

list_jobs.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

list_scripts_parent_hash.rs

fix: make the listScripts parent_hash filter valid SQL (#10752)

2026-08-18 18:22:03 +02:00

mcp_resource_authz.rs

fix(ai): enforce resource authz when loading MCP tools in agent worker (#9571)

2026-06-14 23:50:18 +02:00

mcp_token_exfil.rs

feat: let the global AI chat call connected MCP servers as the user (#10656)

2026-08-14 18:51:19 +02:00

nativets_dedicated.rs

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

nativets_jobs.rs

fix(jobs): sanitize NUL in completed job result before jsonb insert (#10274)

2026-07-23 10:39:38 +02:00

nativets_stress.rs

perf: resolve the worker external IP in the background (#10697)

2026-08-14 14:27:21 +02:00

object_storage_test_ssrf.rs

fix: apply object-storage test SSRF validation to all non-super-admins (#10933)

2026-09-02 22:29:01 +02:00

on_behalf_of.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

operator_db_sync.rs

fix: add secretKeyRef support for jwt_secret and rsa_keys (#8698)

2026-04-03 18:17:27 +00:00

otel.rs

feat(otel): connect jobs to the inbound distributed trace (#9456)

2026-06-05 16:50:07 +00:00

postgres_trigger_scope.rs

feat: guest JWT entry for embedded apps

2026-09-03 08:00:25 +00:00

preserve_on_behalf_of.rs

fix(security): a WM_TOKEN job token can never be a global superadmin (GHSA-hfh4-cx4h-3fcr) (#10124)

2026-08-19 22:33:46 +02:00

preview_native_tag.rs

fix: carry the token label into job-run audit rows (#10433)

2026-07-31 16:13:12 +02:00

protection_rules.rs

fix: let admins edit the dev workspace lock ruleset (#10512)

2026-08-04 18:25:59 +02:00

python_jobs.rs

fix: support @typechecked decorator in Python relative imports (#8495)

2026-08-17 12:30:25 +02:00

raw_app_missing_css.rs

fix: raw apps with no stylesheet were permanently un-deployable (#10364)

2026-07-27 22:32:57 +02:00

relock_noop.rs

fix: deploy a relocked script version only when its lock changed (#10966)

2026-09-04 01:01:36 +02:00

relock_skip.rs

fix: deploy a relocked script version only when its lock changed (#10966)

2026-09-04 01:01:36 +02:00

resource_versioning.rs

feat: version resource values with history, diff and restore (#10596)

2026-08-10 21:32:18 +02:00

restart_at_step_api.rs

feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)

2026-04-28 20:00:03 +00:00

retry.rs

fix(flows): skip_if evaluates wrong previous_result during retry (#9547)

2026-06-12 17:31:31 +02:00

runnables_list_pagination.rs

fix: home search matches each term instead of the whole query verbatim (#10663)

2026-08-12 21:10:56 +02:00

runnables_owner_counts.rs

feat: show per-owner runnable counts in the homepage tree (WIN-2253) (#10351)

2026-07-27 14:57:54 +02:00

script_auto_kind_failure.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

script_auto_parent_archived.rs

fix: reset parent_hash in auto_parent when all versions at path are archived (#9172)

2026-05-16 07:43:35 +00:00

script_modules.rs

feat: Data Pipelines alpha (#9193)

2026-06-18 18:09:02 +02:00

script_rename_clears_assets.rs

fix: clear old path asset usage when renaming a script (#9979)

2026-07-07 14:23:31 +02:00

session_workspace_status.rs

stop destroying AI sessions in workspaces reached without a usr row (#10567)

2026-08-06 12:45:34 +02:00

sign_s3_objects_authz.rs

feat: configurable expiry for presigned s3 public url signatures (#10835)

2026-08-26 00:47:24 +02:00

success_handler.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

suspend_resume.rs

fix: keep the same_worker pin when a suspend ends without approval (#10552)

2026-08-05 23:59:42 +02:00

suspended_pull_index.rs

perf: index the suspended-job resume test instead of filtering it (#10863)

2026-08-27 00:39:03 +02:00

trigger_listener_queries.rs

feat: guest JWT entry for embedded apps

2026-09-03 08:00:25 +00:00

v2_job_delete_orphans.rs

perf: drop v2_job side-table ON DELETE CASCADE FKs to speed retention deletes (#9786)

2026-06-25 13:52:30 +00:00

volume_tests.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

wac_approval_resume.rs

feat: bind WAC approval urls to a named wait_for_approval step (#10317)

2026-07-25 11:41:48 +02:00

wac_approval_urls.rs

feat: bind WAC approval urls to a named wait_for_approval step (#10317)

2026-07-25 11:41:48 +02:00

wm_token_confinement.rs

feat: guest JWT entry for embedded apps

2026-09-03 08:00:25 +00:00

worker_ping_ip.rs

perf: resolve the worker external IP in the background (#10697)

2026-08-14 14:27:21 +02:00

worker.rs

fix(security): a WM_TOKEN job token can never be a global superadmin (GHSA-hfh4-cx4h-3fcr) (#10124)

2026-08-19 22:33:46 +02:00

workspace_dependencies.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

workspace_encryption_key_scope.rs

fix: require an unscoped token to reach the workspace encryption key (#10798)

2026-08-22 09:55:44 +00:00

workspace_export.rs

fix: require admin on workspace tarball settings export (#10817)

2026-08-26 00:49:13 +02:00

workspace_fairness.rs

fix(queue): duration-weighted workspace fairness signal (#9329)

2026-05-26 11:47:45 +00:00

workspace_storage_by_name.rs

fix: name the requested storage when a workspace storage lookup finds nothing (#10803)

2026-08-22 09:50:30 +00:00

ws_specific.rs

fix(security): enforce variables:write scope on resource-delete var cascade (GHSA-xmr2-98m6-cjf7) (#10123)

2026-07-15 13:19:17 +02:00

zombie_flow_recovery.rs

feat(monitor): make between-steps zombie flows hand-recoverable (#10287)

2026-07-23 19:09:28 +02:00