Skip to content

fix: taskupdater result mutable#274

Merged
yarolegovich merged 7 commits intomainfrom
yarolegovich/fix-taskupdate-result-mutable-new
Mar 12, 2026
Merged

fix: taskupdater result mutable#274
yarolegovich merged 7 commits intomainfrom
yarolegovich/fix-taskupdate-result-mutable-new

Conversation

@yarolegovich
Copy link
Copy Markdown
Member

@yarolegovich yarolegovich commented Mar 11, 2026 •
edited
Loading

returning a reference to stored task can lead to unexpected side effects if consumer middleware modifies the task after it's returned:

process(event1) -> task -> middleware modifies the task
process(event2) <- changes made to the task returned after processing event1 appear in the task store.

also removed an outdated taskStateUnknown (not a valid value in the protocol now)

Release-As: 1.0.0

@gemini-code-assist
Copy link
Copy Markdown
Contributor

gemini-code-assist bot commented Mar 11, 2026

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical issue where consumers of the task updater were receiving mutable references to internal task objects, leading to potential unintended state changes. By implementing deep copies for returned task objects and utilizing maps.Copy for metadata updates, the PR ensures that the internal state of the task management system is protected from external modifications, thereby enhancing data integrity and predictability.

Highlights

  • Prevented Mutable Task Results: The saveVersionedTask function now returns a deep copy of the stored task, ensuring that external modifications by consumers do not affect the internal state of the task manager.
  • Improved Metadata Handling: Metadata updates now utilize maps.Copy to prevent direct reference sharing, further safeguarding the internal state from unintended external changes.
  • Enhanced Test Coverage: A new test case was added to TestManager_TaskImmutableAfterSave to explicitly verify that the returned task is immutable, confirming the fix's effectiveness.
Changelog
  • internal/taskupdate/manager.go
    • Refactored metadata copying to use maps.Copy instead of a manual loop.
    • Implemented deep copying of the StoredTask before returning it from saveVersionedTask to ensure immutability.
  • internal/taskupdate/manager_test.go
    • Added a new test case to TestManager_TaskImmutableAfterSave to verify that the returned task's state cannot be modified externally.
Activity
  • No human activity has been recorded on this pull request yet.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist[bot]
gemini-code-assist bot reviewed Mar 11, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

The pull request aims to address a potential mutability issue by introducing a deep copy when returning the stored task, preventing unintended side effects. While this is a good step, the fix is incomplete as several methods still return the internal reference directly. Additionally, a potential Denial of Service (DoS) vulnerability was identified in the updateArtifact function due to improper map capacity allocation based on user-controlled input. There are also suggestions to enhance error wrapping for better debuggability.

nahapetyan-serob
nahapetyan-serob reviewed Mar 11, 2026
View reviewed changes
@yarolegovich yarolegovich merged commit 6038d92 into main Mar 12, 2026
6 checks passed
@yarolegovich yarolegovich deleted the yarolegovich/fix-taskupdate-result-mutable-new branch March 12, 2026 16:25
@a2a-bot a2a-bot mentioned this pull request Mar 11, 2026
Merged
yarolegovich pushed a commit that referenced this pull request Mar 17, 2026
@a2a-bot
chore(main): release 1.0.0 (#252)
67b1354 
🤖 I have created a release *beep* *boop*
---


##
[1.0.0](v1.0.0-alpha.3...v1.0.0)
(2026-03-17)


### Features

* implement the new rest error handling
([#282](#282))
([a3bda30](a3bda30))
* use v2 suffix for module ID and provide compat support
([#270](#270))
([dd1b6ba](dd1b6ba)),
closes [#250](#250)


### Bug Fixes

* a2asrv jsonrpc Content-Type
([#265](#265))
([2568a46](2568a46))
* bugs before going from alpha
([#279](#279))
([b1f055c](b1f055c))
* GetTaskRequest nil pointer assignment check
([#258](#258))
([440bb79](440bb79))
* inject headers into service params
([#277](#277))
([d33f3bd](d33f3bd)),
closes [#275](#275)
* propagate cancelation signal using task store
([#272](#272))
([5e1d462](5e1d462)),
closes [#245](#245)
* regenerate spec and fix returnImmediately
([#284](#284))
([2eee0b9](2eee0b9))
* task modified after save
([#266](#266))
([c15febe](c15febe))
* taskupdater result mutable
([#274](#274))
([6038d92](6038d92))
* update pushsender
([#256](#256))
([5f7a594](5f7a594))
* use enum values as in the spec
([#261](#261))
([eb98981](eb98981)),
closes [#251](#251)


### Documentation

* **a2asrv:** add Example_* test functions for pkg.go.dev documentation
([#262](#262))
([7888e37](7888e37))
* add example tests a2a
([#240](#240))
([4fe08a9](4fe08a9))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nahapetyan-serob nahapetyan-serob nahapetyan-serob approved these changes

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@yarolegovich @nahapetyan-serob