mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-10 16:05:58 +00:00
Ruben FiszelandClaude Opus 5
b4a4cd8fdd
Found by the local Codex and Claude review passes. Each one let an operator with builder rights reach code the composition check was supposed to keep out. - Version-pinned flow steps. A step carrying a `hash` is dispatched by that hash alone: `script_to_payload` ignores the path beside it, reads the row with root permissions, and takes that script's tag and `on_behalf_of` identity. A builder could pin the hash of a script it cannot read under a path it can, and run that instead, possibly as the identity that script runs as. The walk now reports every `(path, hash)` pair and `validate_operator_composed_flow` verifies each against the caller's own permissions. - Raw-script triggerables in a builder-authored app policy. `execute_component`'s run mode authorizes caller-supplied `raw_code` by the policy's `rawscript/<sha>` key alone; its operator guard only covers preview mode. A builder could deploy a clean value whose policy pinned an arbitrary sha, then execute matching code on a worker. Both triggerables maps are now refused such a key, which also closes the policy-supplied worker tag that rode with it. - `inlineScript` without a `language`. `traverse_app_inline_scripts` only reports a script whose language parses and stops descending at the key, which is right for locking and wrong for an authorization check the author's fields control. Replaced with `app_value_has_inline_script`, which refuses the key itself. Also: the builder flag gates writes and was cached per process, so revoking it left every other replica authorizing until its own entry expired. An `AFTER UPDATE OF operator_settings` trigger now emits `notify_operator_settings_change` and `process_notify_event` drops the entry, the same way the other authorization-adjacent caches propagate. And `CreateActionsMenu`'s option list read the store outside a reactive context, so switching workspace without a reload kept the previous workspace's kinds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise