fix(plugin): make payload fields additive on hook infos - #627
Conversation
Addresses the high-severity Codex review comment on #616. Dataclass fields land in the generated repr, and instrumentation logs hook infos wholesale: the bundled OTel plugins at debug level, and the plugin example at info. Customer input and results -- potentially secrets, potentially megabytes -- would therefore be written to logs implicitly, just by adding these fields. Reproduced before fixing. Set repr=False on execution_input and execution_result. Identity fields still render, so the repr stays useful, and the values remain readable through the attributes for plugins that deliberately record them. Adds a regression test asserting secret-looking values never appear in either hook info's repr, plus one pinning the field declarations. Refs #616
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Addresses the medium-severity Codex review comment on #616. The payload fields joined the generated __eq__ and __hash__, so the widening was not additive. execution_input holds arbitrary deserialized JSON, and a dict or list value made a previously hashable InvocationStartInfo raise TypeError on hash(); both fields also made infos built from the earlier field set compare unequal to infos carrying a payload. Both effects were reproduced first. Set compare=False, hash=False on execution_input and execution_result. Identity fields still drive equality, so payload-only differences now compare equal -- payloads are incidental data on what is otherwise an event record. Adds tests for hashability across dict, list, nested and scalar payloads, for equality against the prior field set, and for the field declarations themselves. Note OperationInfo.result / OperationInfo.error from #625 remain in compare. They are hashable types so they do not break hash(), but the equality asymmetry with these fields is worth a maintainer decision. Refs #616
Codex AI reviewNo actionable findings. Static review only; tests were not run per the review constraints. Reviewed commit |
Claude AI reviewThis PR makes the Verified:
No actionable findings. Residual risk (unchanged lines, out of scope): Reviewed commit |
Follow-up to #616, which merged before these could be pushed to its branch.
Addresses both review comments on #616 (commit
d92013f) — both findingslanded on
mainwith the merge, so they are live today.1. High: payloads leaked into
repr(plugin.py:212)Dataclass fields appear in the generated
repr, and instrumentation logs hookinfos wholesale:
aws-durable-execution-sdk-python-otellogs"Durable invocation started: %s", info(and the end hook, and the operation hooks) at debug
f"Invocation started: {info}"at infoSo merely adding
execution_input/execution_resultcaused customer inputand results — potentially secrets, potentially megabytes — to be written to
logs implicitly, with no plugin asking for it. Reproduced before fixing:
Fix:
repr=Falseon both fields. Identity fields (request_id,execution_arn, timestamps, status) still render, so the repr stays useful.2. Medium: payloads changed equality and broke hashing (
plugin.py:183)The fields joined the generated
__eq__/__hash__, so the widening was notadditive. Reproduced:
execution_inputisAny— arbitrary deserialized JSON — so a dict or listvalue made a previously hashable
InvocationStartInfounhashable. Both fieldsalso made infos built from the earlier field set compare unequal to infos
carrying a payload.
Fix:
compare=False, hash=Falseon both. Identity fields still driveequality, so payload-only differences now compare equal — payloads are
incidental data on what is otherwise an event record.
Testing
repr: secret-looking values never appear in either hook info'srepr, whilerequest_id/execution_arnstill do.the payload-free hash.
infos; two different payloads compare equal; identity fields still drive
inequality.
Field.repr/Field.compare/Field.hash,so the intent survives a refactor of the generated methods.
hatch fmt --checkclean.Worth a maintainer decision (not changed here)
OperationInfo.result/OperationInfo.errorfrom #625 remain incompareandin
repr. They are hashable types, so they do not breakhash(), but theycarry operation-level payloads through the same log sites and now differ from
these fields in equality semantics. Aligning them is a small change if you want
consistency.