Webserver: Sanitize string passed to origin param #14738

kaxil · 2021-03-12T03:16:33Z

Since https://github.com/python/cpython/pull/24297/files (bpo-42967)
also removed ';' as query argument separator, we remove query arguments
with semicolons.

^ Add meaningful description above

Read the Pull Request Guidelines for more information.
In case of fundamental code change, Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in UPDATING.md.

Follow-up of apache#12459 & apache#10334 Since https://github.com/python/cpython/pull/24297/files (bpo-42967) also removed ';' as query argument separator, we remove query arguments with semicolons.

kaxil · 2021-03-12T03:17:28Z

This PR will be backported to 1.10.15 too and cherry-picked to 2.0.2

github-actions · 2021-03-12T04:16:08Z

The PR is likely OK to be merged with just subset of tests for default Python and Database versions without running the full matrix of tests, because it does not modify the core of Airflow. If the committers decide that the full tests matrix is needed, they will add the label 'full tests needed'. Then you should rebase to the latest master or amend the last commit of the PR, and push it with --force-with-lease.

(cherry-picked from 409c249)

(cherry-picked from 409c249) (cherry picked from commit c6369be)

Follow-up of apache#12459 & apache#10334 Since https://github.com/python/cpython/pull/24297/files (bpo-42967) also removed ';' as query argument separator, we remove query arguments with semicolons. (cherry picked from commit 409c249)

Follow-up of apache#12459 & apache#10334 Since https://github.com/python/cpython/pull/24297/files (bpo-42967) also removed ';' as query argument separator, we remove query arguments with semicolons. (cherry picked from commit 409c249) (cherry picked from commit 5a42706)

Follow-up of #12459 & #10334 Since https://github.com/python/cpython/pull/24297/files (bpo-42967) also removed ';' as query argument separator, we remove query arguments with semicolons. (cherry picked from commit 409c249)

Looks like "trying to be smart approach" in apache#14738 does not work on old Python versions. The "smart" part being if semicolon exists in URL only those specific query argument were removed. While this solves the issue for Py 3.6.13 it didn't fix for 3.6.12 (although it minimzed it). Python 3.6.12: ```python >>> parse_qsl("r=3;a=b") [('r', '3'), ('a', 'b')] ``` Python 3.6.13: ```python >>> parse_qsl("r=3;a=b") [('r', '3;a=b')] ``` This commit simplifies it and check if the url contains `;`, it just redirects to `/home`.

Follow-up of #12459 & #10334 Since https://github.com/python/cpython/pull/24297/files (bpo-42967) also removed ';' as query argument separator, we remove query arguments with semicolons. (cherry picked from commit 409c249)

Looks like "trying to be smart approach" in #14738 does not work on old Python versions. The "smart" part being if semicolon exists in URL only those specific query argument were removed. While this solves the issue for Py 3.6.13 it didn't fix for 3.6.12 (although it minimzed it). Python 3.6.12: ```python >>> parse_qsl("r=3;a=b") [('r', '3'), ('a', 'b')] ``` Python 3.6.13: ```python >>> parse_qsl("r=3;a=b") [('r', '3;a=b')] ``` This commit simplifies it and check if the url contains `;`, it just redirects to `/home`.

Looks like "trying to be smart approach" in #14738 does not work on old Python versions. The "smart" part being if semicolon exists in URL only those specific query argument were removed. While this solves the issue for Py 3.6.13 it didn't fix for 3.6.12 (although it minimzed it). Python 3.6.12: ```python >>> parse_qsl("r=3;a=b") [('r', '3'), ('a', 'b')] ``` Python 3.6.13: ```python >>> parse_qsl("r=3;a=b") [('r', '3;a=b')] ``` This commit simplifies it and check if the url contains `;`, it just redirects to `/home`. (cherry picked from commit 178dee9)

…e#14905) Looks like "trying to be smart approach" in apache#14738 does not work on old Python versions. The "smart" part being if semicolon exists in URL only those specific query argument were removed. While this solves the issue for Py 3.6.13 it didn't fix for 3.6.12 (although it minimzed it). Python 3.6.12: ```python >>> parse_qsl("r=3;a=b") [('r', '3'), ('a', 'b')] ``` Python 3.6.13: ```python >>> parse_qsl("r=3;a=b") [('r', '3;a=b')] ``` This commit simplifies it and check if the url contains `;`, it just redirects to `/home`. (cherry picked from commit 178dee9)

Follow-up of #12459 & #10334 Since https://github.com/python/cpython/pull/24297/files (bpo-42967) also removed ';' as query argument separator, we remove query arguments with semicolons. (cherry picked from commit 409c249)

Looks like "trying to be smart approach" in #14738 does not work on old Python versions. The "smart" part being if semicolon exists in URL only those specific query argument were removed. While this solves the issue for Py 3.6.13 it didn't fix for 3.6.12 (although it minimzed it). Python 3.6.12: ```python >>> parse_qsl("r=3;a=b") [('r', '3'), ('a', 'b')] ``` Python 3.6.13: ```python >>> parse_qsl("r=3;a=b") [('r', '3;a=b')] ``` This commit simplifies it and check if the url contains `;`, it just redirects to `/home`. (cherry picked from commit 178dee9)

Apache Airflow 1.10.15 - Fix `airflow db upgrade` to upgrade db as intended (apache#13267) - Moved boto3 limitation to snowflake (apache#13286) - `KubernetesExecutor` should accept images from `executor_config` (apache#13074) - Scheduler should acknowledge active runs properly (apache#13803) - Bugfix: Unable to import Airflow plugins on Python 3.8 (apache#12859) - Include `airflow/contrib/executors` in the dist package - Pin Click version for Python 2.7 users - Ensure all statsd timers use millisecond values. (apache#10633) - [`kubernetes_generate_dag_yaml`] - Fix dag yaml generate function (apache#13816) - Fix `airflow tasks clear` cli command wirh `--yes` (apache#14188) - Fix permission error on non-POSIX filesystem (apache#13121) (apache#14383) - Fixed deprecation message for "variables" command (apache#14457) - BugFix: fix the `delete_dag` function of json_client (apache#14441) - Fix merging of secrets and configmaps for `KubernetesExecutor` (apache#14090) - Fix webserver exiting when gunicorn master crashes (apache#13470) - Bump ini from 1.3.5 to 1.3.8 in `airflow/www_rbac` - Bump datatables.net from 1.10.21 to 1.10.23 in `airflow/www_rbac` - Webserver: Sanitize string passed to origin param (apache#14738) - Make `rbac_app`'s `db.session` use the same timezone with `@provide_session` (apache#14025) - Adds airflow as viable docker command in official image (apache#12878) - `StreamLogWriter`: Provide (no-op) close method (apache#10885) - Add 'airflow variables list' command for 1.10.x transition version (apache#14462) - Update URL for Airflow docs (apache#13561) - Clarifies version args for installing 1.10 in Docker (apache#12875)

Looks like "trying to be smart approach" in apache/airflow#14738 does not work on old Python versions. The "smart" part being if semicolon exists in URL only those specific query argument were removed. While this solves the issue for Py 3.6.13 it didn't fix for 3.6.12 (although it minimzed it). Python 3.6.12: ```python >>> parse_qsl("r=3;a=b") [('r', '3'), ('a', 'b')] ``` Python 3.6.13: ```python >>> parse_qsl("r=3;a=b") [('r', '3;a=b')] ``` This commit simplifies it and check if the url contains `;`, it just redirects to `/home`. (cherry picked from commit 178dee9a5ed0cde3d7a7d4a47daeae85408fcd67) GitOrigin-RevId: be9881b132ca8803ef8d9564df0b25eb99db87f4

Looks like "trying to be smart approach" in apache/airflow#14738 does not work on old Python versions. The "smart" part being if semicolon exists in URL only those specific query argument were removed. While this solves the issue for Py 3.6.13 it didn't fix for 3.6.12 (although it minimzed it). Python 3.6.12: ```python >>> parse_qsl("r=3;a=b") [('r', '3'), ('a', 'b')] ``` Python 3.6.13: ```python >>> parse_qsl("r=3;a=b") [('r', '3;a=b')] ``` This commit simplifies it and check if the url contains `;`, it just redirects to `/home`. GitOrigin-RevId: 178dee9a5ed0cde3d7a7d4a47daeae85408fcd67

Apache Airflow 1.10.15 - Fix `airflow db upgrade` to upgrade db as intended (apache#13267) - Moved boto3 limitation to snowflake (apache#13286) - `KubernetesExecutor` should accept images from `executor_config` (apache#13074) - Scheduler should acknowledge active runs properly (apache#13803) - Bugfix: Unable to import Airflow plugins on Python 3.8 (apache#12859) - Include `airflow/contrib/executors` in the dist package - Pin Click version for Python 2.7 users - Ensure all statsd timers use millisecond values. (apache#10633) - [`kubernetes_generate_dag_yaml`] - Fix dag yaml generate function (apache#13816) - Fix `airflow tasks clear` cli command wirh `--yes` (apache#14188) - Fix permission error on non-POSIX filesystem (apache#13121) (apache#14383) - Fixed deprecation message for "variables" command (apache#14457) - BugFix: fix the `delete_dag` function of json_client (apache#14441) - Fix merging of secrets and configmaps for `KubernetesExecutor` (apache#14090) - Fix webserver exiting when gunicorn master crashes (apache#13470) - Bump ini from 1.3.5 to 1.3.8 in `airflow/www_rbac` - Bump datatables.net from 1.10.21 to 1.10.23 in `airflow/www_rbac` - Webserver: Sanitize string passed to origin param (apache#14738) - Make `rbac_app`'s `db.session` use the same timezone with `@provide_session` (apache#14025) - Adds airflow as viable docker command in official image (apache#12878) - `StreamLogWriter`: Provide (no-op) close method (apache#10885) - Add 'airflow variables list' command for 1.10.x transition version (apache#14462) - Update URL for Airflow docs (apache#13561) - Clarifies version args for installing 1.10 in Docker (apache#12875)

Looks like "trying to be smart approach" in apache/airflow#14738 does not work on old Python versions. The "smart" part being if semicolon exists in URL only those specific query argument were removed. While this solves the issue for Py 3.6.13 it didn't fix for 3.6.12 (although it minimzed it). Python 3.6.12: ```python >>> parse_qsl("r=3;a=b") [('r', '3'), ('a', 'b')] ``` Python 3.6.13: ```python >>> parse_qsl("r=3;a=b") [('r', '3;a=b')] ``` This commit simplifies it and check if the url contains `;`, it just redirects to `/home`. GitOrigin-RevId: 178dee9a5ed0cde3d7a7d4a47daeae85408fcd67

Webserver: Sanitize string passed to origin param

e144865

Follow-up of apache#12459 & apache#10334 Since https://github.com/python/cpython/pull/24297/files (bpo-42967) also removed ';' as query argument separator, we remove query arguments with semicolons.

kaxil added this to the Airflow 2.0.2 milestone Mar 12, 2021

kaxil requested a review from ashb March 12, 2021 03:16

kaxil requested a review from ryanahamilton as a code owner March 12, 2021 03:16

boring-cyborg bot added the area:webserver Webserver related Issues label Mar 12, 2021

kaxil modified the milestones: Airflow 2.0.2, Airflow 1.10.15 Mar 12, 2021

jhtimmins approved these changes Mar 12, 2021

View reviewed changes

github-actions bot added the okay to merge It's ok to merge this PR as it does not require more tests label Mar 12, 2021

kaxil merged commit 409c249 into apache:master Mar 12, 2021

kaxil deleted the sanitize-url branch March 12, 2021 09:49

kaxil added a commit that referenced this pull request Mar 12, 2021

Webserver: Sanitize string passed to origin param (#14738)

dd0f252

(cherry-picked from 409c249)

kaxil added a commit that referenced this pull request Mar 12, 2021

Webserver: Sanitize string passed to origin param (#14738)

c6369be

(cherry-picked from 409c249)

kaxil added a commit to astronomer/airflow that referenced this pull request Mar 16, 2021

Webserver: Sanitize string passed to origin param (apache#14738)

d38d362

(cherry-picked from 409c249) (cherry picked from commit c6369be)

kaxil added a commit to astronomer/airflow that referenced this pull request Mar 16, 2021

Webserver: Sanitize string passed to origin param (apache#14738)

469faa8

(cherry-picked from 409c249) (cherry picked from commit c6369be)

kaxil added a commit to astronomer/airflow that referenced this pull request Mar 16, 2021

Webserver: Sanitize string passed to origin param (apache#14738)

825f250

(cherry-picked from 409c249) (cherry picked from commit c6369be)

kaxil added a commit to astronomer/airflow that referenced this pull request Mar 16, 2021

Webserver: Sanitize string passed to origin param (apache#14738)

c0c4ff8

(cherry-picked from 409c249) (cherry picked from commit c6369be)

kaxil mentioned this pull request Mar 19, 2021

Simplify cleaning string passed to origin param (#14738) #14905

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Webserver: Sanitize string passed to origin param #14738

Webserver: Sanitize string passed to origin param #14738

kaxil commented Mar 12, 2021

kaxil commented Mar 12, 2021

github-actions bot commented Mar 12, 2021

Webserver: Sanitize string passed to origin param #14738

Webserver: Sanitize string passed to origin param #14738

Conversation

kaxil commented Mar 12, 2021

kaxil commented Mar 12, 2021

github-actions bot commented Mar 12, 2021