Repository navigation
fix(cloud): Reject malformed connection IDs in CloudWorkspace.get_connection - #1379
Conversation
A malformed connection ID previously surfaced as an opaque HTTP 500 from the Cloud API. CloudWorkspace.get_connection now raises AirbyteLibInputError before any request is made. Co-Authored-By: AJ Steers <[email protected]>
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
👋 Greetings, Airbyte Team Member!Here are some helpful tips and reminders for your convenience. 💡 Show Tips and TricksTesting This PyAirbyte VersionYou can test this version of PyAirbyte using the following: # Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1792014086-validate-connection-id' pyairbyte --help
# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1792014086-validate-connection-id'PR Slash CommandsAirbyte Maintainers can execute the following slash commands on your PR:
📚 Show Repo GuidanceHelpful ResourcesCommunity SupportQuestions? Join the #pyairbyte channel in our Slack workspace. |
Code coverage overviewLanguages: Python Python / code-coverage/pytest-no-creds
View coverage of the 10 most impacted files.
Python / code-coverage/pytest
View coverage of the 10 most impacted files.
Python / code-coverage/pytest-unit
Line coverage data for the release-candidate/v1 branch is not yet available. View coverage of the 10 most covered files.
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
…ests Co-Authored-By: AJ Steers <[email protected]>
There was a problem hiding this comment.
🟢 Approval recommended
The focused validation matches the stated behavior, and no blocking issues were identified.
0 open findings
What changed in this PR
Adds local UUID validation to CloudWorkspace.get_connection, rejecting malformed connection IDs with a clear input error.
Changes:
- Validates connection IDs and documents
AirbyteLibInputError. - Adds unit coverage for malformed IDs and valid UUIDs.
| File | Description |
|---|---|
| tests/unit_tests/test_cloud_connections.py | Tests rejection of malformed IDs and acceptance of valid UUIDs. |
| airbyte/cloud/workspaces.py | Adds UUID validation and documents the input error. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-Authored-By: AJ Steers <[email protected]>
d476bba
into
release-candidate/v1
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| AirbyteLibInputError: If `connection_id` is not a valid UUID. | ||
| """ | ||
| try: | ||
| uuid.UUID(connection_id) |
There was a problem hiding this comment.
🟡 Malformed connection IDs still reach Cloud
For a UUID with misplaced hyphens, uuid.UUID succeeds and get_connection accepts the malformed ID. CloudConnection keeps the original string, so API calls can still return HTTP 500.
Learn more
Python's UUID parser removes hyphens anywhere in the string before checking the hex digits. It also accepts braces and a URN prefix. This method ignores the parsed value and passes the original string to CloudConnection, which forwards it unchanged through _fetch_connection_info. The server can therefore receive a malformed path ID despite successful local validation.
Example: 1234-5678-1234-1234-1234-1234567890ab parses as a UUID, but the connection lookup still sends that exact, wrongly grouped ID.
Recommended fix: Require the connection ID to match the server's canonical UUID string format before constructing CloudConnection; compare the original ID with the parsed canonical representation if the server supports lowercase canonical IDs only, or explicitly account for accepted case variants.
Was this helpful? React with 👍 or 👎 to provide feedback.
Overview
👉 TL;DR: A malformed connection ID used to reach Airbyte Cloud and come back as a bare HTTP 500. It is now rejected up front with a clear input error.
Specifically,
CloudWorkspace.get_connectionchecksuuid.UUID(connection_id)and raisesAirbyteLibInputError("connection_idmust be a UUID.").Related: https://linear.app/airbyteio/issue/AGENTIC-2301 (broader risky-args hardening; this PR covers only malformed connection IDs).
Risks
CloudWorkspace.get_connection(and so to every MCP tool that takes aconnection_id). They now getAirbyteLibInputErrorbefore any API call. Real Cloud connection IDs are always UUIDs.Test plan
Link to Devin session: https://app.devin.ai/sessions/a51d808f26c9402fafc93e7640648187
Open in Devin Desktop: https://app.devin.ai/desktop/session/a51d808f26c9402fafc93e7640648187?variant=devin
Requested by: Aaron ("AJ") Steers (@aaronsteers)
Important
Auto-merge enabled.
This PR is set to merge automatically when all requirements are met.