Giter Site home page Giter Site logo

omes's Introduction

Omes - a load generator for Temporal

This project is for testing load generation scenarios against Temporal. This is primarily used by the Temporal team to benchmark features and situations. Backwards compatibility may not be maintained.

Why the weird name?

Omes (pronounced oh-mess) is the Hebrew word for "load" (עומס).

Prerequisites

(More TBD when we support workers in other languages)

Installation

There's no need to install anything to use this, it's a self-contained Go project.

Usage

Define a scenario

Scenarios are defined using plain Go code. They are located in the scenarios folder. There are already multiple defined that can be used.

A scenario must select an Executor. The most common is the KitchenSinkExecutor which is a wrapper on the GenericExecutor specific for executing the Kitchen Sink workflow. The Kitchen Sink workflow accepts actions and is implemented in every worker language.

For example, here is scenarios/workflow_with_single_noop_activity.go:

func init() {
	loadgen.MustRegisterScenario(loadgen.Scenario{
		Description: "Each iteration executes a single workflow with a noop activity.",
		Executor: loadgen.KitchenSinkExecutor{
			WorkflowParams: kitchensink.NewWorkflowParams(kitchensink.NopActionExecuteActivity),
		},
	})
}

NOTE: The file name where the Register function is called, will be used as the name of the scenario.

Scenario Authoring Guidelines

  1. Use snake case for scenario file names.
  2. Use KitchenSinkExecutor for most basic scenarios, adding common/generic actions as need, but for unique scenarios use GenericExecutor.
  3. When using GenericExecutor, use methods of *loadgen.Run in your Execute as much as possible.
  4. Liberally add helpers to the loadgen package that will be useful to other scenario authors.

Run a worker for a specific language SDK

go run ./cmd run-worker --scenario workflow_with_single_noop_activity --run-id local-test-run --language go

Notes:

  • --embedded-server can be passed here to start an embedded localhost server
  • --task-queue-suffix-index-start and --task-queue-suffix-index-end represent an inclusive range for running the worker on multiple task queues. The process will create a worker for every task queue from <task-queue>-<start> through <task-queue>-end. This only applies to multi-task-queue scenarios.

Run a test scenario

go run ./cmd run-scenario --scenario workflow_with_single_noop_activity --run-id local-test-run

Notes:

  • Run ID is used to derive ID prefixes and the task queue name, it should be used to start a worker on the correct task queue and by the cleanup script.
  • By default the number of iterations or duration is specified in the scenario config. They can be overridden with CLI flags.
  • See help output for available flags.

Cleanup after scenario run

go run ./cmd cleanup-scenario --scenario workflow_with_single_noop_activity --run-id local-test-run

Run scenario with worker - Start a worker, an optional dev server, and run a scenario

go run ./cmd run-scenario-with-worker --scenario workflow_with_single_noop_activity --language go --embedded-server

Notes:

  • Cleanup is not automatically performed here
  • Accepts combined flags for run-worker and run-scenario commands

Building and publishing docker images

For example, to build a go worker image using v1.24.0 of the Temporal Go SDK:

go run ./cmd build-worker-image --language go --version v1.24.0

This will produce an image tagged like <current git commit hash>-go-v1.24.0.

Publishing images is typically done via CI, using the push-images command. See the GHA workflows for more.

Design decisions

Kitchen Sink Workflow

The Kitchen Sink workflows accepts a DSL generated by the kitchen-sink-gen Rust tool, allowing us to test a wide variety of scenarios without having to imagine all possible edge cases that could come up in workflows. Input may be saved for regression testing, or hand written for specific cases.

Scenario Failure

A scenario can only fail if an Execute method returns an error, that means the control is fully in the scenario authors's hands. For enforcing a timeout for a scenario, use options like workflow execution timeouts or write a workflow that waits for a signal for a configurable amount of time.

TODO

  • Nicer output that includes resource utilization for the worker (when running all-in-one)
  • More lang workers

Fuzzer trophy case

  • Python upsert SA with no initial attributes: PR
  • Core cancel-before-start on abandon activities: PR
  • Core panic on evicting run with buffered tasks: PR

omes's People

Contributors

aromanovich avatar bergundy avatar cretz avatar dandavison avatar michaelsnowden avatar quinn-with-two-ns avatar robholland avatar sushisource avatar yux0 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar

omes's Issues

json-path-2.6.0.jar: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - json-path-2.6.0.jar

Java port of Stefan Goessner JsonPath.

Library home page: https://github.com/jayway/JsonPath

Path to dependency file: /workers/java/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.jayway.jsonpath/json-path/2.6.0/67f565b424f7903a12d4f5b9361b11462ecacdac/json-path-2.6.0.jar

Found in HEAD commit: 789df2448690450734b1a488672f96f52be3d523

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (json-path version) Remediation Possible**
CVE-2023-1370 High 7.5 json-smart-2.4.7.jar Transitive 2.8.0
CVE-2023-51074 Medium 5.3 json-path-2.6.0.jar Direct com.jayway.jsonpath:json-path:2.9.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-1370

Vulnerable Library - json-smart-2.4.7.jar

JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.

Library home page: https://urielch.github.io/

Path to dependency file: /workers/java/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/net.minidev/json-smart/2.4.7/8d7f4c1530c07c54930935f3da85f48b83b3c109/json-smart-2.4.7.jar

Dependency Hierarchy:

  • json-path-2.6.0.jar (Root Library)
    • json-smart-2.4.7.jar (Vulnerable Library)

Found in HEAD commit: 789df2448690450734b1a488672f96f52be3d523

Found in base branch: main

Vulnerability Details

Json-smart is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

Publish Date: 2023-03-22

URL: CVE-2023-1370

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/

Release Date: 2023-03-22

Fix Resolution (net.minidev:json-smart): 2.4.9

Direct dependency fix Resolution (com.jayway.jsonpath:json-path): 2.8.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-51074

Vulnerable Library - json-path-2.6.0.jar

Java port of Stefan Goessner JsonPath.

Library home page: https://github.com/jayway/JsonPath

Path to dependency file: /workers/java/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.jayway.jsonpath/json-path/2.6.0/67f565b424f7903a12d4f5b9361b11462ecacdac/json-path-2.6.0.jar

Dependency Hierarchy:

  • json-path-2.6.0.jar (Vulnerable Library)

Found in HEAD commit: 789df2448690450734b1a488672f96f52be3d523

Found in base branch: main

Vulnerability Details

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Publish Date: 2023-12-27

URL: CVE-2023-51074

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-51074

Release Date: 2023-12-27

Fix Resolution: com.jayway.jsonpath:json-path:2.9.0

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Task queue partition count configuration

It should be possible to configure the task queue partition count for the task queue being used for the test. This effects polling efficiency which is a core component of Temporal performance tuning.

[Feature Request] Allow throughput_stress scenario to run against Cloud.

Is your feature request related to a problem? Please describe.

Currently running the throughput_stress scenario against cloud fails because it tries to add a search attribute using the OperatorService which is not permitted on Cloud.

Describe the solution you'd like

Either an option to skip adding the search attribute, relying on a user to add it, or support for using whichever API is required on Cloud.

Additional context

Slot and poller configuration for worker

It should be possible to configure the execution slots and the poller counts for the worker. Polling efficiency is core component of tuning Temporal performance.

logback-classic-1.2.9.jar: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - logback-classic-1.2.9.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /workers/java/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.2.9/7d495522b08a9a66084bf417e70eedf95ef706bc/logback-classic-1.2.9.jar

Found in HEAD commit: 4ebaa816e1175a27784bcaae991d9c6eb15d3b8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (logback-classic version) Remediation Possible**
CVE-2023-6481 High 7.5 logback-core-1.2.9.jar Transitive 1.2.13
CVE-2023-6378 High 7.5 logback-classic-1.2.9.jar Direct 1.2.13

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-6481

Vulnerable Library - logback-core-1.2.9.jar

logback-core module

Library home page: http://logback.qos.ch

Path to dependency file: /workers/java/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.2.9/cdaca0cf922c5791a8efa0063ec714ca974affe3/logback-core-1.2.9.jar

Dependency Hierarchy:

  • logback-classic-1.2.9.jar (Root Library)
    • logback-core-1.2.9.jar (Vulnerable Library)

Found in HEAD commit: 4ebaa816e1175a27784bcaae991d9c6eb15d3b8d

Found in base branch: main

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-12-04

URL: CVE-2023-6481

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-6481

Release Date: 2023-12-04

Fix Resolution (ch.qos.logback:logback-core): 1.2.13

Direct dependency fix Resolution (ch.qos.logback:logback-classic): 1.2.13

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-6378

Vulnerable Library - logback-classic-1.2.9.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /workers/java/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.2.9/7d495522b08a9a66084bf417e70eedf95ef706bc/logback-classic-1.2.9.jar

Dependency Hierarchy:

  • logback-classic-1.2.9.jar (Vulnerable Library)

Found in HEAD commit: 4ebaa816e1175a27784bcaae991d9c6eb15d3b8d

Found in base branch: main

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-11-29

URL: CVE-2023-6378

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://logback.qos.ch/news.html#1.3.12

Release Date: 2023-11-29

Fix Resolution: 1.2.13

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Scenario request: Lots of namespaces with varying amounts of traffic

Describe the scenario you'd like

Create <namespace-count> namespaces, then run <workflow-count> workflows across them with <frequency> frequency on each <configurable-percent> percent. Basically need to have some amount of namespaces busy, some less busy, some mostly idle, etc.

The variables can be set based on good numbers that stress the environment.

go.temporal.io/sdk-v1.24.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - go.temporal.io/sdk-v1.24.0

Path to dependency file: /workers/go/go.mod

Path to vulnerable library: /workers/go/go.mod,/go.mod

Found in HEAD commit: 71bf6314822328d5f995b7f8a56196fab7c98902

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (go.temporal.io/sdk-v1.24.0 version) Remediation Possible**
CVE-2023-39325 High 7.5 golang.org/x/net-v0.14.0 Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-39325

Vulnerable Library - golang.org/x/net-v0.14.0

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.14.0.zip

Path to dependency file: /workers/go/go.mod

Path to vulnerable library: /workers/go/go.mod,/go.mod

Dependency Hierarchy:

  • go.temporal.io/sdk-v1.24.0 (Root Library)
    • github.com/grpc-ecosystem/go-grpc-mIddleware-v1.4.0
      • golang.org/x/net-v0.14.0 (Vulnerable Library)

Found in HEAD commit: 71bf6314822328d5f995b7f8a56196fab7c98902

Found in base branch: main

Vulnerability Details

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

Publish Date: 2023-10-11

URL: CVE-2023-39325

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pkg.go.dev/vuln/GO-2023-2102

Release Date: 2023-10-11

Fix Resolution: go1.20.10, go1.21.3, golang.org/x/net - v0.17.0

[Feature Request] Make output the same for same RNG seed

Ideally this would return the same value, but it doesn't currently (even after #57):

md5sum <(cargo run -- generate --explicit-seed=12345 2>/dev/null) <(cargo run -- generate --explicit-seed=12345 2>/dev/null)

I believe that this is due to the fact that serializing the WorkflowState HashMap yields keys and values in non-deterministic order. If so, it doesn't impact correctness, but it would still be reassuring to see the same output.

Fix this and add a test for same-seed-same-output.

go.temporal.io/sdk-v1.25.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - go.temporal.io/sdk-v1.25.0

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/net/@v/v0.14.0.mod,/go/pkg/mod/cache/download/golang.org/x/net/@v/v0.14.0.mod

Found in HEAD commit: 4ebaa816e1175a27784bcaae991d9c6eb15d3b8d

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (go.temporal.io/sdk-v1.25.0 version) Remediation Possible**
CVE-2023-39325 High 7.5 golang.org/x/net-v0.14.0 Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-39325

Vulnerable Library - golang.org/x/net-v0.14.0

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.14.0.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/net/@v/v0.14.0.mod,/go/pkg/mod/cache/download/golang.org/x/net/@v/v0.14.0.mod

Dependency Hierarchy:

  • go.temporal.io/sdk-v1.25.0 (Root Library)
    • google.golang.org/grpc-v1.57.0
      • golang.org/x/net-v0.14.0 (Vulnerable Library)

Found in HEAD commit: 4ebaa816e1175a27784bcaae991d9c6eb15d3b8d

Found in base branch: main

Vulnerability Details

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

Publish Date: 2023-10-11

URL: CVE-2023-39325

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pkg.go.dev/vuln/GO-2023-2102

Release Date: 2023-10-11

Fix Resolution: go1.20.10, go1.21.3, golang.org/x/net - v0.17.0

Ability to remote write metrics to prometheus

Given omes and it's workers will be short lived it probably won't be easy to scrape metrics from them reliably. It would be preferable to add support for prometheus remote write for this use case so that the worker will push its metrics to prometheus.

guava-31.1-jre.jar: 1 vulnerabilities (highest severity is: 7.1)

Vulnerable Library - guava-31.1-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, Google's collections, I/O classes, and much more.

Path to dependency file: /workers/java/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/31.1-jre/60458f877d055d0c9114d9e1a2efb737b4bc282c/guava-31.1-jre.jar

Found in HEAD commit: 789df2448690450734b1a488672f96f52be3d523

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (guava version) Remediation Possible**
CVE-2023-2976 High 7.1 guava-31.1-jre.jar Direct 32.0.1-android

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-2976

Vulnerable Library - guava-31.1-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, Google's collections, I/O classes, and much more.

Path to dependency file: /workers/java/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/31.1-jre/60458f877d055d0c9114d9e1a2efb737b4bc282c/guava-31.1-jre.jar

Dependency Hierarchy:

  • guava-31.1-jre.jar (Vulnerable Library)

Found in HEAD commit: 789df2448690450734b1a488672f96f52be3d523

Found in base branch: main

Vulnerability Details

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Mend Note: Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Publish Date: 2023-06-14

URL: CVE-2023-2976

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7g45-4rm6-3mm3

Release Date: 2023-06-14

Fix Resolution: 32.0.1-android

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Scenario request: Lots of workflows with lots of updates that have slow validators

Describe the scenario you'd like

Run <workflow-count> workflows that are sent<update-count>updates. Updates should have validators that reject a '' number of updates. The validation step should incorporate some non trivial amount of delay to emulate a real validator. These updates should do some minor work like an activity.

The variables can be set based on good numbers that stress the environment.

Scenario request: Continue as new on workflow with lots of events

Describe the scenario you'd like

Run <workflow-count> workflows that generate <event-count> events (sequential activities with fake input/output payload, combine with some fake signals for example) and then continue as new. The workflow should do this event-build-and-continue-as-new <continue-as-new-iterations> times. May want to break up events with only so many in a single task instead of all in one.

The variables can be set based on good numbers that stress the environment.

Scenario request: Continue as new with too-frequent signals

Describe the scenario you'd like

Run <workflow-count> workflows where each will wait for of signals to be received, for each received signal, run a local-activity that produce a marker. Each workflow would take to finish (maybe control by local-activity). Once of signal is received, drain the signal channel and continue as new.
Separately, there is a client that keeps sending signals to the workflow (can be a long running activity that started by the workflow), and the time between signals has chance shorter than . This will cause workflow to have chance to fail continue_as_new with "unhandled command".

The variables can be set based on good numbers that stress the environment.

Scenario request: Lots of workflows with lots of updates as we kill workers

Describe the scenario you'd like

Run <workflow-count> workflows on multiple workers that are sent<update-count>updates,. These updates should do some minor work like an activity. The validation step should incorporate some non trivial amount of delay to emulate a real validator. While sending updates kill workers in a non-graceful way. It is expected that no updates should get dropped and not completed.

The variables can be set based on good numbers that stress the environment.

go.temporal.io/sdk-v1.18.1: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - go.temporal.io/sdk-v1.18.1

Found in HEAD commit: 547f54d5dc447045e6d655f4600f4d49fb6dbde8

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (go.temporal.io/sdk-v1.18.1 version) Remediation Available
CVE-2022-41723 High 7.5 golang.org/x/net-v0.2.0 Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-41723

Vulnerable Library - golang.org/x/net-v0.2.0

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.2.0.zip

Dependency Hierarchy:

  • go.temporal.io/sdk-v1.18.1 (Root Library)
    • github.com/grpc-ecosystem/go-grpc-middleware-v1.3.0
      • golang.org/x/net-v0.2.0 (Vulnerable Library)

Found in HEAD commit: 547f54d5dc447045e6d655f4600f4d49fb6dbde8

Found in base branch: main

Vulnerability Details

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Publish Date: 2022-09-29

URL: CVE-2022-41723

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2023-1568

Release Date: 2022-09-29

Fix Resolution: v0.7.0

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.