dapr / js-sdk

Dapr SDK for Javascript
Apache License 2.0
194 stars 82 forks source link

ActorId accepts invalid IDs, causing issues when making Actor HTTP calls #537

Closed heunghingwan closed 9 months ago

heunghingwan commented 10 months ago

When constructing an actor using strings such as url, it will throw with app-id not found error. I don’t know whether it is an SDK or core error.

Steps to Reproduce the Problem

const actor = await builder.build(new ActorId(url)) actor.test() <- throw with app-id not found

shubham1172 commented 10 months ago

So URLs should not be allowed as actor IDs because of the way actor APIs are written, reference: https://docs.dapr.io/reference/api/actors_api/#get-actor-reminder

For example, if actor ID is https://foo.bar, the below request will look like /actors/${actorType}/https://foo.bar/state/${key} https://github.com/dapr/js-sdk/blob/b063e10e4b1a122fe7bc266d1681ca0727b6a522/src/actors/client/ActorClient/ActorClientHTTP.ts#L50

What we should do is throw an error if the actor ID is not proper or potentially sanitize it, instead of simply accepting any string. https://github.com/dapr/js-sdk/blob/b063e10e4b1a122fe7bc266d1681ca0727b6a522/src/actors/ActorId.ts#L20

heunghingwan commented 10 months ago

Does this mean it will work when using grpc protocol?

XavierGeerinck commented 10 months ago

Does this mean it will work when using grpc protocol?

It would, but gRPC is not supported on the runtime :)