Headline
CVE-2023-25696: Validate Hive Beeline parameters by potiuk · Pull Request #29502 · apache/airflow
Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am now of an opinion that constructors in our operators should just assign fields. Full stop.
Yes, same. I guess I figured since this was a hook, we’re not moving the connection call out, and it’s currently not going to get called in an operator, why not push up the validation? But I see it was misguided suggestion.
…get rid of explicit constructor and turn all our operators in ‘dataclasses’
I would be over the moon if this was the implementation or attrs; the latter has been life changing. It’s a shame you can’t build an operator now, with any real added value in simplication, with attrs because of the metaclass logic going on. Alas, I would love this.
Related news
Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.