a2aproject / a2aproject/a2a-python

[Bug]: In-memory push store keeps the caller object so later mutations rewrite stored webhooks

Ouverte
#1,215 1 commentaire 0 réactions 1 personne assignée Réclamée par @rohityan Voir sur GitHub
component: server status:awaiting response
Langage dominant
Python
Étoiles
2.1k
Forks
496
Merge moyen
4 j 17 h
PR mergées (30 j)
12

Description

### What happened?

`InMemoryPushNotificationConfigStore.set_info` appends the caller proto and `get_info` / `get_info_for_dispatch` return those same objects.

After create/get, changing `url`/`token`/`id` on the request or response proto silently changes the stored webhook. The next `send_notification` POSTs to the mutated URL.

`DatabasePushNotificationConfigStore` already `CopyFrom`s. `InMemoryTaskStore` wraps `CopyingTaskStoreAdapter` for the same reason. The JS SDK had this class of bug and cloned on save.

**Repro**
```python
cfg = TaskPushNotificationConfig(url="http://a.example/cb")
await store.set_info("t1", cfg, ctx)
cfg.url = "http://evil.example/cb"
got = await store.get_info("t1", ctx)
```

Observed: `got[0].url == "http://evil.example/cb"`
Expected: stored copy still `"http://a.example/cb"`

### Relevant log output

n/a.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.