mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-21 00:02:30 +00:00

Files

T

Alexander PetricandClaude Opus 4.8 4cb89d0b8d address review (rubenfiszel): gate on token lifetime, mint only from job_perms row

Security: on the agent-worker path the completion payload's owner fields
(permissioned_as/email) are attacker-supplied, and create_token_for_owner(perms:
None) falls back to fetch_authed_from_permissioned_as — letting a completion mint
a token for an arbitrary identity. Instead fetch the server-written job_perms row
and pass Some(perms); when the row is absent (e.g. zombie replay after the queue
row was reaped) keep the step token rather than trusting the payload.

Gating: refresh based on the token's actual remaining lifetime (DB-free
decode_without_verify) instead of step duration. This confines the extra
get_job_perms lookup to near-expiry completions and also covers completions with
no recorded duration (Noop/cache), which the duration guard missed.

Add job_token_remaining_lifetime_secs + JOB_TOKEN_REFRESH_MARGIN_SECS (must
exceed the 60s JWT leeway) in windmill-common::auth, with unit tests pinning the
margin-vs-leeway invariant and the near-expiry detection.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-30 18:27:10 +02:00

nsjail

fix(worker): mount /dev/shm as tmpfs in the Docker v2 nsjail sandbox (#10240 )

2026-07-21 15:49:29 +00:00

src

address review (rubenfiszel): gate on token lifetime, mint only from job_perms row

2026-07-30 18:27:10 +02:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

feat: make bigquery and snowflake script languages available in CE (#10324 )