GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Require confirmation for code from /create/ links, and restrict credentialed CORS by Karakatiza666 · Pull Request #7806 · feldera/feldera

Conversation

Karakatiza666 commented Nov 3, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Fixes for a pentest finding: opening a /create/?name=...&program.sql=...&udf.rs=... link created and compiled a pipeline with the link's code on page load. Any third-party page could make the console compile code the user never saw.

Commits

[pipeline-manager] Allow credentialed CORS only for configured origins. Without allowed_origins, the API allowed any origin together with credentials. The any-origin default now no longer allows credentials. Clients that send an Authorization header still work.
[web-console] Confirm before compiling code from a /create/ link. A /create/ link with code creates an empty pipeline and opens the link's code as unsaved edits. While the pipeline holds code from a link, autosave is off. Every save shows a "Compile code from a link?" dialog. Confirming saves all files. If the name is taken, the existing duplicate-name helper picks a -copy name. Links without code still open a demo by name.
[web-console] Let Start save unsaved changes and schedule the start.
- Start is always enabled when there are unsaved changes, including while compiling and in error states. Start saves first, which shows the dialog only for code from a link.
- Start waits for the PATCH requests to finish, then posts start. pipeline-manager starts the pipeline after compilation.
- The compiling cause 'upgrade' is renamed to 'start', meaning a start is scheduled.
- "Cancel start" force-stops without a dialog.
- The disabled Start keeps its split-button chevron.

Testing

e2e: tests/pastedLink.e2e.ts and tests/startUnsavedChanges.e2e.ts.
Unit: usePastedLink.spec.ts and pipelineManager.spec.ts.
Rust: v0_preflight_from_any_origin_is_not_credentialed.

Release note

When allowedOrigins (--allowed-origins) is not set, cross-origin browser requests to the API no longer allow credentials (cookies, HTTP authentication). Requests with an Authorization header still work. If a browser app on another origin uses credentials: 'include' or withCredentials, or a cookie or Basic-auth proxy sits in front of Feldera, add that origin to allowedOrigins.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Karakatiza666 requested a review from anandbraman

November 3, 2026 19:31

gz approved these changes

Nov 3, 2026

View reviewed changes

Karakatiza666 added this pull request to the merge queue

Nov 3, 2026

mythical-fred-oss Bot reviewed

Nov 3, 2026

View reviewed changes

Comment thread

crates/pipeline-manager/src/config.rs

		.supports_credentials(),
		// Any origin may call the API, but browsers send no cookies or HTTP auth.
		// The API needs neither because clients set the `Authorization` header.
		None => cors.allow_any_origin(),

mythical-fred-oss Bot Nov 3, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing / medium (docs, breaking-change gate): This changes the default (allowed_origins unset): browser clients on another origin that use credentials: 'include' (cookies or HTTP auth) now fail CORS. Please document it in three places:

a Behavior change entry in docs.feldera.com/docs/changelog.md, next to the other entries under Unreleased
helm-chart-reference.md:185, which still says "null permits all origins". Add: "without credentials; list origins to allow credentialed requests"
the --allowed-origins doc comment (config.rs:1315), which becomes the CLI help

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mythical-fred-oss Bot commented Nov 3, 2026

Copy link

Copy Markdown

Contributor

Review: what I ran

Check	Result
`cargo test --locked -p pipeline-manager preflight` / `cors` (includes the new `v0_preflight_from_any_origin_is_not_credentialed`)	✅ 6 tests pass
`vitest --project server` (includes `usePastedLink.spec`, `pipelineManager.spec`)	✅ 486/486 pass
`svelte-check`	✅ 0 errors
`vitest --project client`, Playwright e2e, `pre-commit`	⚠️ not run: no browser in this environment, and pre-commit timed out while installing hooks

I traced every save path for a way to save link code without the dialog. Ctrl+S, Accept Local, conflict auto-push, the leave-page dialog and Start all go through saveAll → confirmSave. Debounced autosave is off while a link entry exists. patch() adds the request to pendingPatches synchronously, so settlePendingPatches cannot miss a PATCH before the start request. I found no bypass.

missing / medium (docs gate): the CORS default changed, but there is no changelog entry and the helm docs are not updated. Details are in the inline comment.
missing / medium (tests): the e2e tests only cover cancelling from the leave-page dialog. These cases have no tests:
1. "Save and continue" → confirm the link dialog → the code is saved and the navigation completes.
2. A link with udf.rs when allow_rust_udfs=false: the draft is dropped, but the dialog still lists udf.rs.
3. Start when a PATCH fails: saveBeforeStart returns false silently, and nothing checks that the user sees an error.

Otherwise it looks good. The commits are clean and the PR includes tests.

Karakatiza666 reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Karakatiza666 removed this pull request from the merge queue due to a manual request

Nov 3, 2026

Karakatiza666 force-pushed the web-console-pasted-link-confirmation branch from dbdd3b5 to 8972c2d Compare

November 3, 2026 22:10

Karakatiza666 enabled auto-merge

November 3, 2026 22:11

Karakatiza666 added 3 commits

November 3, 2026 22:12


          [pipeline-manager] Allow credentialed CORS only for configured origins

7125f03

Without `allowed_origins`, the API accepted any origin and also allowed
credentials. A page on another site could then send requests with the
browser's cookies or HTTP auth.

Credentialed CORS is now limited to the origins listed in
`allowed_origins`. The any-origin default still lets clients call the
API with an `Authorization` header, but no longer allows credentials.

This came out of a pentest finding about cross-site requests through
the web console.

Signed-off-by: Karakatiza666 <[email protected]>


          [web-console] Confirm before compiling code from a /create/ link

dba16ce

A pentest found that opening a link like
`/create/?name=...&program.sql=...&udf.rs=...` created and compiled a
pipeline with the link's code on page load, so a third-party page could
make the console compile code the user never saw.

A /create/ link with code now creates an empty pipeline and opens the
link's code as unsaved edits. While the pipeline holds code from a link,
autosave is off and every save shows a "Compile code from a link?"
dialog that lists the files. Confirming saves all unsaved files and
restores the user's autosave setting. Links without code still open a
demo by name.

CodeEditor gets `autoSave` and `confirmSave` props, an `initialDraft`
per file, and a single `saveAll` used by every save path. `saveFile` now
resolves to whether the save happened, and declining the save from the
unsaved-changes dialog keeps the user on the page.

Signed-off-by: Karakatiza666 <[email protected]>


          [web-console] Let Start save unsaved changes and schedule the start

4cb009f

Start, Start paused, Resume and Standby were disabled while the code had
unsaved changes. They are now always enabled: they save the code first
(which can show the pasted-link confirmation), wait for the in-flight
PATCH requests, and then post the start. pipeline-manager starts the
pipeline once the compilation ends.

The compiling status `cause` 'upgrade' is renamed to 'start', meaning a
start is scheduled after the compilation. Start stays enabled while the
pipeline compiles with cause 'compile', and in error states when there
are unsaved changes that may fix the error. "Cancel start" force-stops
without a dialog, since the pipeline has not run yet, and the optimistic
status keeps the compiling state. The grayed-out Start is a split button
with a disabled chevron, so it keeps the layout of the enabled one.

Signed-off-by: Karakatiza666 <[email protected]>

Karakatiza666 force-pushed the web-console-pasted-link-confirmation branch from 8972c2d to 4cb009f Compare

November 3, 2026 22:18

Karakatiza666 disabled auto-merge

November 3, 2026 22:18

Karakatiza666 enabled auto-merge

November 3, 2026 22:18

Karakatiza666 disabled auto-merge

November 4, 2026 15:27

Karakatiza666 added this pull request to the merge queue

Nov 4, 2026

Merged via the queue into main with commit c591af2

Nov 4, 2026

1 check passed

Uh oh!

There was an error while loading. Please reload this page.

Karakatiza666 deleted the web-console-pasted-link-confirmation branch

November 4, 2026 20:22

Reviewers

mythical-fred-oss[bot]

mythical-fred-oss[bot] left review comments

gz approved these changes

anandbraman

Awaiting requested review from anandbraman

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Karakatiza666 commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Commits

Testing

Release note

Uh oh!

mythical-fred-oss Bot Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

mythical-fred-oss Bot commented Nov 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Karakatiza666 commented Nov 3, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.