Repository navigation
Restrict Azure Storage large-message resolution to the current task hub - #1427
Merged
Merged
Conversation
Naiyuan Tian (nytian)
force-pushed
the
nytian/blob-content
branch
from
October 27, 2026 05:48
1178872 to
26ad0a9
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Security-sensitive URI and serialization changes need human validation across supported deployments, and a regression-test assertion still needs correction.
No open issues 🎉
What changed in this PR
This PR restricts Azure Storage large-message resolution to the configured account and task hub, preventing unrelated private blob URLs from being downloaded with application credentials. It also hardens Service Fabric serialization defaults.
Changes:
- Validate large-message references and explicit downloads against the configured container.
- Apply scoped validation to orchestration and entity-state hydration, with regression tests.
- Restore the default allowed-types serialization binder when configured with
null.
| File | Description |
|---|---|
| test/DurableTask.AzureStorage.Tests/MessageManagerTests.cs | Tests accepted references and rejection of out-of-scope URLs. |
| test/DurableTask.AzureStorage.Tests/AzureStorageScenarioTests.cs | Tests private blob URLs remaining literal management reasons. |
| Test/DurableTask.AzureServiceFabric.Tests/AllowedTypesSerializationBinderTests.cs | Updates the null-binder expectation. |
| src/DurableTask.AzureStorage/Tracking/AzureTableTrackingStore.cs | Uses scoped validation for orchestration input hydration. |
| src/DurableTask.AzureStorage/MessageManager.cs | Enforces account and container boundaries for blob resolution. |
| src/DurableTask.AzureStorage/EntityTrackingStoreQueries.cs | Uses scoped validation for entity-state hydration. |
| src/DurableTask.AzureStorage/AzureStorageOrchestrationService.cs | Documents rejection of out-of-scope downloads. |
| src/DurableTask.AzureServiceFabric/Service/Startup.cs | Ensures a serialization binder is always applied. |
| src/DurableTask.AzureServiceFabric/FabricOrchestrationProviderSettings.cs | Restores the default binder on null assignment. |
Review effort: Balanced
…etask into nytian/blob-content
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Varshitha Bachu (bachuv)
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restrict large-message URL recognition and downloads to the configured storage account and task hub’s large-message container.
Previously, URL-shaped orchestration output, including termination, suspension, and resumption reasons, could cause unrelated private Blobs to be downloaded using the application’s storage credentials.
This change:
• Preserves out-of-scope URLs as literal input/output text.
• Rejects explicit downloads outside the large-message container.
• Applies scoped validation to orchestration and entity-state hydration.
• Preserves existing large-message references within the configured container.