SEC-SR-001 — Parameterize reads and authorize the managed Workflow
| Field | Value |
|---|---|
| Status | Open; source-verified; deployed exploitability not tested |
| Severity | High |
| Components | sparqd/spark-recommendation, sparqd/bff-api, sparqd/workflow-backend, Trino |
| Associated issue | Not opened |
Current behavior and evidence
BFF requires a valid browser JWT but accepts supplied DAG names and does not
resolve view permission for a managed Workflow. The internal FastAPI service has
no caller-authentication middleware. It embeds a normalized dagName inside a
Trino SQL string; quotes and SQL syntax are not parameterized. Hyphen/underscore
removal can also collapse distinct names.
The job sends Spark properties, execution summaries, and resource metrics to an AI gateway. An explicit allowlist/redaction and model retention boundary is not implemented in this repository.
Expected condition
The read begins with immutable Workflow identity, resolves authorization before data access, and calls an authenticated internal service. Queries are parameterized and bounded. Prompt construction allowlists fields, removes secrets, and records approved model, residency, logging, retention, and tenant isolation behavior.
Alternatives considered
- Recommended: BFF asks workflow-backend to authorize Workflow UUID, then uses authenticated service identity and immutable keys.
- Put authorization directly in the recommendation service. Viable only if it consumes the canonical Workflow/OpenFGA contract rather than duplicating it.
- Escape the DAG-name string. Rejected as the primary control because it does not solve resource authorization, identity collisions, or query bounds.
Reproduction and verification
Follow SR-S007.
Resolution conditions
Close when unauthorized Workflow advice is denied before query execution, internal callers authenticate, names cannot alter SQL or collide through lossy normalization, and AI-bound fields satisfy an approved data-governance contract.