Azure / Azure/azure-functions-host

Function name validation not being enforced in Worker Indexing

Open
#10,962 0 comments 0 reactions 1 assignee Claimed by @RohitRanjanMS View on GitHub
bug
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

Currently it's possible for a .NET Isolated function to define a function name containing slashes, e.g. "components/{id}". You can find examples in Kusto:

```
All("FunctionsLogs")
| where PreciseTimeStamp > ago(1d)
| where FunctionName contains "/"
| distinct AppName, FunctionName
| take 10
```

We have regex validation [here](https://github.com/Azure/azure-functions-host/blob/f6013e9323db82b7b2a3de592fce7d356275b3d1/src/WebJobs.Script.WebHost/Controllers/FunctionsController.cs#L79) that runs when functions are created/updated. Traditionally before worker indexing, host indexing would derive the name of the function from the folder on disk where the function.json was found, and because filenames can't contain "/" slashes, we knew the names couldn't contain slashes. The WebJobs SDK during indexing will also validate names applied via FunctionNameAttribute [here](https://github.com/Azure/azure-webjobs-sdk/blob/71f8d54d5ee9a8d6f2f60cac2f5f1ef9a88d5799/src/Microsoft.Azure.WebJobs.Host/Indexers/FunctionIndexer.cs#L404). However, I believe that only applies to in-proc functions.

It appears that customers may be doing this to define route templates, but this isn't the correct way of doing so. They should be using the "route" property of the http binding to define their routes, as documented [here](https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook-trigger?tabs=python-v2%2Cisolated-process%2Cnodejs-v4%2Cfunctionsv2&pivots=programming-language-csharp#customize-the-http-endpoint).

I suspect that worker indexing is allowing invalid names through.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.