Harden _collect_teams_to_check / requires_access_backfill against malformed bodies

[potiuk]

The authorization helpers in core_api/security.py read fields directly from the raw request JSON body before Pydantic body-validation runs on the actual endpoint handler. Two related defects that share the same fix pattern:

Commit 1: Fail closed on JSON parse failure (FINDING-008 from L1 sweep)

For POST/PUT in multi-team mode, _collect_teams_to_check used with suppress(JSONDecodeError) around await request.json(). If the body was unparseable, the suppress swallowed the exception, teams.add(raw) never ran, and the calling requires_access_* dependency iterated over an empty set — silently skipping the authorization callback entirely.

Replace the bare suppress with an explicit try/except that adds None to teams on parse failure, so the auth callback always runs at least once.

Commit 2: Reject non-string dag_id / team_name from raw body before authz (FINDING-060 from L3 sweep)

_collect_teams_to_check reads team_name, and requires_access_backfill reads dag_id, from the raw JSON body before Pydantic validation runs on the actual endpoint handler. If a body contains a non-string value (list, dict, integer, …) those values would otherwise flow into Team.get_name_if_exists / the authz callback / the existence lookup, producing undefined behaviour or type-confused authz decisions.

Raise 400 Bad Request on a non-string team_name / dag_id before any auth check runs. Tests parametrised on integer / list / dict / bool inputs assert the 400 + that the authz callback is never consulted.

Reachability today

Both defects are unreachable in current core_api routes because every POST/PUT route uses a Pydantic body model, so FastAPI returns 422 before the auth dependency runs on a malformed body. The patterns would silently bypass team-scoped authz if a future route used a raw Request instead — both fixes are defense-in-depth, not exploitable today.

Reported by

• Airflow-side audit triage — apache/tooling-agents#23 (FINDING-008 from L1, FINDING-060 from L3)

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

[potiuk]

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

---

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

[vatsrahul1001]

Ready for maintainer review

[jason810496]

Not sure would it be better to early return to avoid the further bypass.

[vatsrahul1001]

@potiuk can you address comments?

[amoghrajesh]

Commit 2: Reject non-string dag_id / team_name from raw body before authz (FINDING-060 from L3 sweep)

Is this in this PR? I cannot see in the diff

[potiuk]

Addressed all three review points in f0d28ed:

@jason810496 — agreed, switched to raising HTTP_400_BAD_REQUEST directly on JSONDecodeError instead of falling through to a team=None auth call. Updated the existing parse-failure test (renamed ..._fails_closed → ..._returns_400) to assert the 400 and that is_authorized_connection is never called.

@amoghrajesh —

• Moved from json import JSONDecodeError to the top of test_security.py.
• On commit 2 not being in the diff: you were right, the non-string rejection was in a second commit on my local branch but only the first one made it into the original push — sorry about that. It's now in this update, with parametrised tests covering integer / list / dict / bool inputs for both `team_name` (via `requires_access_connection`) and `dag_id` (via `requires_access_backfill`). Both raise `400` before any authz callback or DB lookup runs.

---

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

[potiuk]

@amoghrajesh — yes, commit 2 (f0d28ed81c, "Reject malformed bodies in core_api authz helpers with 400") is the FINDING-060 changes. They're visible in the current diff:

• _collect_teams_to_check — if raw is not None and not isinstance(raw, str): raise HTTPException(400, "'team_name' must be a string") (security.py L777-782).
• requires_access_backfill — if dag_id is not None and not isinstance(dag_id, str): raise HTTPException(400, "'dag_id' must be a string") (security.py L344-349).

Plus parametrised tests for both in test_security.py (test_requires_access_connection_non_string_team_name_returns_400 and test_requires_access_backfill_non_string_dag_id_returns_400).

If GitHub's diff UI is hiding them, refreshing against PR HEAD f0d28ed81c4feb42e6759bb2c83f1a15bef20985 should show them.

---

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

[github-actions]

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

[pierrejeambrun]

We need this too I believe for the newly introduced `requires_access_event_log, I'll open a PR for it.

edit: We don't, that's only required for bodies. Path params are already validated beforehand.