Repository navigation
Conversation
| return err | ||
| } | ||
|
|
||
| // If the task has a modality then there must be an input. |
There was a problem hiding this comment.
I'm considering it an error if the task has a modality but there's no input. However, if there's no configured modality then that should be valid right?
There was a problem hiding this comment.
I think that is right, if there is no modality then no input is expected, otherwise input is expected.
| return | ||
| } | ||
|
|
||
| // Validate the task against the input. |
There was a problem hiding this comment.
We could do this check in a preprocessing step in the runner. However I thought it would be less clunky here since we can detect the error without instantiating the runner and return the 422 directly.
There was a problem hiding this comment.
yea that makes sense, we decode it then validate it before we do execution related stuff. We might want to include everything in the handler inside the execution timeout and check for the ctx.Err() between steps, though, in case we have some edge case that takes a long time to do a step like a DDOS style attack.
Scope of changes
This adds input modality checking for HTTP horizon routes to fix the bug where horizon was accepting attachments with file types unsupported by the configured task.
Fixes SC-41423
Estimated PR Size
Acceptance criteria
[Describe how reviewers can test this change to be sure that it works correctly or copy the requirements from the Shortcut story. Add a checklist below if possible.]
Author checklist
/docs/directory, package docs, tool docs, etc.)