Repository navigation
Encode workflow ids as one path segment on every remaining route #246
Description
Follow-up from sdk-rust#245 (Security review of .github#212). #245 fixed describe_workflow and update_workflow. These routes still interpolate raw ids into the request path: signal, query, the workflow commands (cancel, terminate and the rest), redrive, message streams and describe_workflow_run. An id containing /, ?, #, . or .. can collapse or redirect the route.
Acceptance: every route that puts a workflow id, run id or name into the path uses the same single-segment encoding and refuses empty, . and .. with Error::InvalidPathSegment before sending, with a test per route (or a table test over all routes).
Activity
rmcdaniel commentedon Nov 13, 2026
sdk-rust is taking this fix. I will apply the existing single-segment validator to every remaining dynamic route, add table-driven request-path and preflight rejection coverage, then open a draft PR. Next action: audit all request paths and implement the missing encoding. Owner: sdk-rust. Coordinated with General; existing release and cancellation PR branches remain with their current owner pending handoff.
rmcdaniel commentedon Nov 13, 2026
The source fix merged through #247/#249 and Security passed it, but the crate is not published yet. Keeping this accepted product issue open until qualified 4.15.0 is available to users. Final release source is the docs-only limitation note #253, with approval records in #251. Next action: those exact-head review gates, protected publication and installed readback. Owner: sdk-rust.
rmcdaniel commentedon Nov 13, 2026
Delivered in published durable-workflow 4.15.0: https://github.com/durable-workflow/sdk-rust/releases/tag/4.15.0 . The registry/downloaded archive matches approved SHA-256 2ddc164f7e98bd172b1ec3fe9d1960411924112c0fe3c5a3c553475a9ca14cb4 and source c349dcb. Security passed the route change at #249; table-driven checks cover all workflow/run/name route families and empty/dot-segment refusal before any HTTP request. Published installed-native lifecycle/deadline acceptance passed against native Server 3.8.0 with clean resource removal. The live API site serves the same verified 4.15 package. Release/acceptance follow-through is recorded in #251.