pengjunjie/langflow
1
0
Fork 1
mirror of https://github.com/langflow-ai/langflow.git synced 2026-07-23 17:58:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): pin watsonx orchestrate run target to the deployment resource key

Browse Source 
build_orchestrate_run_payload resolved the run's agent_id as
provider_data.get("agent_id") or deployment_id. The caller-supplied branch is
dead today (the API input slot WatsonxApiExecutionInput is extra="forbid" and
has no agent_id field), so it always fell back to deployment_id. Drop the dead
fallback and pin agent_id to the deployment's own owner-controlled resource key
so a future caller that bypasses the input slot cannot redirect the run to an
arbitrary agent in the owner's WxO tenant. Defense-in-depth; no behavior change.
This commit is contained in:
Jordan Frazier
2026-06-08 18:57:08 -04:00
parent 45ed045896
commit 103cc20ae2
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/backend/base/langflow/services/adapters/deployment/watsonx_orchestrate/core/execution.py
View File

@ -26,7 +26,11 @@ def build_orchestrate_run_payload(
payload: dict[str, Any] = {
"message": message_payload,
"agent_id": str(provider_data.get("agent_id") or deployment_id),
# The run target is always the deployment's own (owner-pinned) resource key. Do NOT honor a
# caller-supplied provider_data["agent_id"]: the API input slot (WatsonxApiExecutionInput) is
# extra="forbid" so it can't arrive today, and reading it here would let a future caller that
# bypasses the slot redirect the run to an arbitrary agent in the owner's WxO tenant.
"agent_id": str(deployment_id),
}
thread_id = provider_data.get("thread_id")