Conversation
The dependencies graph scoped its nodes by which Dags the caller may read, but never by which assets. A caller who can read a Dag saw every asset that Dag produces or consumes, name included, even when the auth manager scopes that asset away from them; the data graph would also expand outward through such an asset. Asset names commonly encode bucket, table or dataset names, so this is the same class of gap the rest of the asset API closed.
henry3260
requested review from
bugraoz93,
choo121600,
ephraimbuddy,
jason810496,
pierrejeambrun,
rawwar and
shubhamraj-git
as code owners
September 11, 2026 20:18
fat-catTW
reviewed
Sep 17, 2026
An asset_expression leaf whose id the Dag processor has not filled in yet cannot be authorized, so it must be hidden like any other asset the caller may not read. The data graph instead parsed the id out of the node, which failed the request outright rather than dropping the node.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GET /ui/dependenciesscopes its graph by which Dags the caller may read, but never by which assets. Both modes leak asset identity to a caller who can read a Dag but not one of its assets:dependency_type=schedulingexpands each readable Dag'sasset_expressioninto asset nodes whose label is the asset name.dependency_type=dataguards the root asset only by checking that some connected Dag is readable. Once that passes, the whole lineage graph is expanded with asset names, and the traversal keeps walking outward through assets the caller may not read.The rest of the asset API already scopes responses with
ReadableAssetsFilterDep(#72682), and #72864 applies the same per-asset readability to asset expressions. Asset names commonly encode bucket, table or dataset names, so this is the same class of gap.What
airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dependencies.py: injectReadableAssetsFilterDepand pass the readable asset ids to both service functions.airflow-core/src/airflow/api_fastapi/core_api/services/ui/dependencies.py:hide_unreadable_assetspost-processes the finished graph, droppingassetnodes the caller may not read and every edge touching them. Alias and ref nodes carry no asset id to authorize on and are left in place, matching Hide unreadable assets in the asset expression served by next_run_assets #72864.get_data_dependenciesreturns the same empty result as an unrelated asset when the root asset is unreadable, so the route's existing 404 path serves it and the endpoint is not an oracle for asset ids. The BFS intersects each round with the readable set so it does not expand through an unreadable asset.Was generative AI tooling used to co-author this PR?