Skip to content

Conversation

@vbrodsky
Copy link
Contributor

@vbrodsky vbrodsky commented Sep 13, 2023

story: https://labelbox.atlassian.net/browse/SDK-246

reusing existing sdk methods to first get the data row id by global key and then get the data row

following existing exception handling paradigm

added sdk integration test and manually tested failure scenarios

NOTE: there is currently no way in the API / ADV to get a data row by global key directly

Returns: DataRow: returns a single data row given the global key
"""

res = self.get_data_row_ids_for_global_keys([global_key])
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Partial success is possible here and I think should be handled here as well

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Partial? But for this call we have only 1 global key (this is equivalent to client.get_data_row(data_row_id)

@vbrodsky
Copy link
Contributor Author

Re: snyk issue
They claim that the code in get_data_row_ids_for_external_ids might be explored for SSRF ... I suppose that someone might inject something via the external_ids parameter? While I can not be a judge of this, this method was there prior and my PR does not touch it. I will bring up a need for security review of sdk to my team though

@vbrodsky vbrodsky merged commit 1cb2185 into develop Sep 14, 2023
@vbrodsky vbrodsky deleted the VB/get-datarow-by-global-key_SDK-246 branch September 14, 2023 17:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants