Unhandled Type Conversion and Logic Errors in Workflows
Description:
The /workflows endpoint contains unsafe parsing logic for the schedule_seconds field. The code performs int(schedule_seconds) if schedule_seconds else None without a try-except block.
Impact:
If a user submits a non-numeric string (e.g., "abc") for schedule_seconds, the int() conversion will raise a ValueError, causing the FastAPI endpoint to crash and return a 500 Internal Server Error instead of a 400 Bad Request. Additionally, there are no bounds checks to ensure schedule_seconds isn't extremely small (e.g., 1 second) or negative, potentially causing a scheduler loop resource exhaustion.
Recommendation:
Wrap type conversions in try-except blocks or rely on strictly typed Pydantic models to catch validation errors automatically. Furthermore, implement bounds checking (e.g., schedule_seconds >= 60) to prevent abuse of the scheduler.
Unhandled Type Conversion and Logic Errors in Workflows
Description:
The
/workflowsendpoint contains unsafe parsing logic for theschedule_secondsfield. The code performsint(schedule_seconds) if schedule_seconds else Nonewithout atry-exceptblock.Impact:
If a user submits a non-numeric string (e.g.,
"abc") forschedule_seconds, theint()conversion will raise aValueError, causing the FastAPI endpoint to crash and return a 500 Internal Server Error instead of a 400 Bad Request. Additionally, there are no bounds checks to ensureschedule_secondsisn't extremely small (e.g.,1second) or negative, potentially causing a scheduler loop resource exhaustion.Recommendation:
Wrap type conversions in try-except blocks or rely on strictly typed Pydantic models to catch validation errors automatically. Furthermore, implement bounds checking (e.g.,
schedule_seconds >= 60) to prevent abuse of the scheduler.