a2aproject / a2aproject/a2a-python

[Bug]: In-memory push store keeps the caller object so later mutations rewrite stored webhooks

未关闭
#1,215 1 条评论 0 个 reaction 已指派 1 人 已被 @rohityan 认领 在 GitHub 查看
component: server status:awaiting response
主要语言
Python
星标
2.1k
派生
496
平均合并
4 天 17 小时
30 天内合并 PR
12

描述

### What happened?

`InMemoryPushNotificationConfigStore.set_info` appends the caller proto and `get_info` / `get_info_for_dispatch` return those same objects.

After create/get, changing `url`/`token`/`id` on the request or response proto silently changes the stored webhook. The next `send_notification` POSTs to the mutated URL.

`DatabasePushNotificationConfigStore` already `CopyFrom`s. `InMemoryTaskStore` wraps `CopyingTaskStoreAdapter` for the same reason. The JS SDK had this class of bug and cloned on save.

**Repro**
```python
cfg = TaskPushNotificationConfig(url="http://a.example/cb")
await store.set_info("t1", cfg, ctx)
cfg.url = "http://evil.example/cb"
got = await store.get_info("t1", ctx)
```

Observed: `got[0].url == "http://evil.example/cb"`
Expected: stored copy still `"http://a.example/cb"`

### Relevant log output

n/a.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。