[haseebmalik18]

A HITL response whose params_input contains a serde-reserved key (__classname__ or __id__) cannot be serialized when the task resumes. Today the response is silently discarded and the user has no way to resubmit a corrected one.

This validates params_input when the response is submitted and returns a 400 if it carries one of those keys, before anything is written. The task stays in AWAITING_INPUT, so the user can fix the input and resubmit.

Only the public HITL route needs this. The execution API route builds its params_input from trusted operator code rather than user input, so it is left as is.

closes: #71036

[amoghrajesh]

This doesn't have to be in 3.3.1, but if we are comfortable (cc @Lee-W) we can consider it.

[Lee-W]

A few nitpicks, but overall this looks good. I also don't think it's worth blocking the 3.3.1 release.

[vatsrahul1001]

Moved to 3.3.2

[haseebmalik18]

@Lee-W Applied changes left from review

[jason810496]

Thanks for fixing this.

[jason810496]

Additionally, we could introduce a common function to handle at both side.

[vatsrahul1001]

LGTM! @Lee-W can you review this again?

[jason810496]

I prefer to move this to 3.3.3 milestone since the #71054 (comment) comment hasn't be addressed.

[haseebmalik18]

Addressed the comments

[jason810496]

LGTM once these comments be addressed, thanks.

[haseebmalik18]

Addressed review comments

[jason810496]

LGTM now, thanks for the update.

[henry3260]

looks good!!

[henry3260]

nit: This docstring also cites the old method (‎_walk)

airflow/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_xcom.py

Lines 867 to 870 in 0bac615

	def test_create_xcom_entry_blocks_forbidden_keys_in_json_string(self, test_client, value):
	"""A forbidden payload submitted as a JSON string literal is blocked too.
	``_check_forbidden_xcom_keys._walk`` previously descended dict/list/tuple but not

[haseebmalik18]

Fixed stale reference

[github-actions]

Backport failed to create: v3-3-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
❌	v3-3-test

You can attempt to backport this manually by running:

cherry_picker 1e1fcd2 v3-3-test

This should apply the commit to the v3-3-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.