Netflix / conductor

Conductor is a microservices orchestration engine.
Apache License 2.0
12.81k stars 2.34k forks source link

Fix: #3876 Update task utils: removeIterationFromTaskRefName #3878

Open appunni-old opened 12 months ago

appunni-old commented 12 months ago

Parsing name is not considering task ref name with double underscores

Pull Request type

NOTE: Please remember to run ./gradlew spotlessApply to fix any format violations.

Changes in this PR

Describe the new behavior from this PR, and why it's needed Issue #3876 If taskRefName with double underscore is not considered, then task creation would go into infinite loop. This can be used also as an attack vector on conductor installation as this causes DDos

Alternatives considered

Add validation in the create start workflow / create workflow definition api

Describe alternative implementation you have considered

v1r3n commented 11 months ago

Hi @appunni-m can you fix the build?

appunni-old commented 11 months ago

@v1r3n hey I have fixed the build.

appunni-old commented 11 months ago

I am making one more change @v1r3n this will solve for #3880 as well

manan164 commented 11 months ago

Hi @appunni-m , Is there a particular reason that you are using double underscore in the task reference name?

appunni-old commented 11 months ago

@manan164 i take it as input from user, thus I don't want to take chances with it. There are no validations against it either.

appunni-old commented 11 months ago

@manan164 can we merge this ? Any blocker ?