mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-21 08:02:38 +00:00

Files

T

Ruben FiszelandClaude Opus 4.8 5401e1e7c8 fix(apps): run-mode inline app component runs only the pinned content

`execute_component` is mounted in `unauthed_service()`; for an anonymous-mode app
it is reachable without authentication and the job runs on-behalf-of the app
publisher. A run-mode no-id inline `raw_code` runnable is authorized only against
the `sha256(content)` policy pin, so every other `raw_code` field was
caller-controlled: `lock` is installed verbatim (a PEP 508 direct URL builds an
sdist and runs `setup.py`; a bun lock runs `postinstall`), `modules` are inline
sources, and `hash` becomes the job's `runnable_id`, making the worker fetch and
run a deployed script by hash instead of the pinned content — each is code
execution as the publisher.

This run-mode no-id arm is legacy back-compat: current deploys assign an
`app_script` id (reduce_app) and take the id-based arm, which reads the
server-stored lock. In run mode, rebuild the inline payload from the
pin-authorized fields only (`content`, `language`, `path`, `cache_ttl`) and
default the rest, so a caller cannot smuggle a lock, modules, hash or any future
field into a publisher-run job. Preview mode (the app editor / `wmill app dev`,
run as the authenticated non-operator caller — the `/jobs/run/preview`
equivalent) is unchanged and still honors caller-supplied fields.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-15 14:43:17 +02:00