Azure / Azure/azure-functions-host
Function name validation not being enforced in Worker Indexing
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
Currently it's possible for a .NET Isolated function to define a function name containing slashes, e.g. "components/{id}". You can find examples in Kusto:
```
All("FunctionsLogs")
| where PreciseTimeStamp > ago(1d)
| where FunctionName contains "/"
| distinct AppName, FunctionName
| take 10
```
We have regex validation [here](https://github.com/Azure/azure-functions-host/blob/f6013e9323db82b7b2a3de592fce7d356275b3d1/src/WebJobs.Script.WebHost/Controllers/FunctionsController.cs#L79) that runs when functions are created/updated. Traditionally before worker indexing, host indexing would derive the name of the function from the folder on disk where the function.json was found, and because filenames can't contain "/" slashes, we knew the names couldn't contain slashes. The WebJobs SDK during indexing will also validate names applied via FunctionNameAttribute [here](https://github.com/Azure/azure-webjobs-sdk/blob/71f8d54d5ee9a8d6f2f60cac2f5f1ef9a88d5799/src/Microsoft.Azure.WebJobs.Host/Indexers/FunctionIndexer.cs#L404). However, I believe that only applies to in-proc functions.
It appears that customers may be doing this to define route templates, but this isn't the correct way of doing so. They should be using the "route" property of the http binding to define their routes, as documented [here](https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook-trigger?tabs=python-v2%2Cisolated-process%2Cnodejs-v4%2Cfunctionsv2&pivots=programming-language-csharp#customize-the-http-endpoint).
I suspect that worker indexing is allowing invalid names through.
Contributor guide
Assessment
This issue has not been assessed yet.