mirror of
https://github.com/hanzoai/tasks.git
synced 2026-11-03 03:56:04 +00:00
Fred TzengandGitHub
15d3acac38
## What changed? Add internal task queue name validation for standalone activities. Harden /_sys/ prefix validation in NormalizeAndValidateUserDefined, which also applies to StartWorkflow, SignalWithStart, Schedules, ContinueAsNew, and StartChild. Polish error messages. Split up activity task queue validation between standalone and embedded. ## Why? We should guard against users specifying task queue names and prefixes reserved for internal purposes. Embedded activities still must allow PerNSWorkerTaskQueue since they can be used internally today. ## How did you test it? - [X] built - [X] run locally and tested manually - [X] covered by existing tests - [X] added new unit test(s) - [ ] added new functional test(s)
46 lines
1.6 KiB
Go
46 lines
1.6 KiB
Go
package primitives
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"go.temporal.io/api/serviceerror"
|
|
)
|
|
|
|
// all internal task queues shall be defined here such that we enhance security on top of them
|
|
const (
|
|
DefaultWorkerTaskQueue = "default-worker-tq"
|
|
PerNSWorkerTaskQueue = "temporal-sys-per-ns-tq"
|
|
|
|
MigrationActivityTQ = "temporal-sys-migration-activity-tq"
|
|
AddSearchAttributesActivityTQ = "temporal-sys-add-search-attributes-activity-tq"
|
|
DeleteNamespaceActivityTQ = "temporal-sys-delete-namespace-activity-tq"
|
|
DLQActivityTQ = "temporal-sys-dlq-activity-tq"
|
|
)
|
|
|
|
func IsInternalPerNsTaskQueue(taskQueue string) bool {
|
|
return taskQueue == PerNSWorkerTaskQueue
|
|
}
|
|
|
|
// CheckInternalPerNsTaskQueueAllowed tries to block the usage of internal per-namespace task queue for illegal cases.
|
|
// Parameters:
|
|
// - targetTaskQueue: The task queue of the component.
|
|
// - parentTaskQueue: The task queue of the parent component can be empty if the component has no parent.
|
|
//
|
|
// Returns an error if the usage is illegal, or nil if it's allowed.
|
|
func CheckInternalPerNsTaskQueueAllowed(targetTaskQueue, parentTaskQueue string) error {
|
|
if targetTaskQueue == "" {
|
|
return serviceerror.NewInvalidArgument("target task queue is not set")
|
|
}
|
|
if !IsInternalPerNsTaskQueue(targetTaskQueue) {
|
|
return nil
|
|
}
|
|
if !IsInternalPerNsTaskQueue(parentTaskQueue) {
|
|
errMessage := fmt.Sprintf("cannot use internal per-namespace task queue:%s", targetTaskQueue)
|
|
if parentTaskQueue != "" {
|
|
errMessage += fmt.Sprintf(" (in parent component task queue: %s)", parentTaskQueue)
|
|
}
|
|
return serviceerror.NewInvalidArgument(errMessage)
|
|
}
|
|
return nil
|
|
}
|