[v3-2-test] Fix TypeError in GET /dags/{dag_id}/tasks when order_by field has None values (apache#64384)

The tasks endpoint crashed with a 500 Internal Server Error when sorting
by a field (e.g. start_date) that contains None values, because Python 3
cannot compare None with None using '<'.

This adds explicit validation of the order_by parameter against a
whitelist of sortable fields (returning 400 for invalid fields, consistent
with SortParam used in other endpoints) and handles None values in the
sort key so nullable fields work correctly.

Closes: apache#63927
(cherry picked from commit 15cf396)

Co-authored-by: Antonio Mello <ajgcvm@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

airflow-core/src/airflow/api_fastapi/core_api/routes/public/tasks.py

@@ -17,7 +17,6 @@
 
 from __future__ import annotations
 
-from operator import attrgetter
 from typing import cast
 
 from fastapi import Depends, HTTPException, status
@@ -33,6 +32,29 @@
 
 tasks_router = AirflowRouter(tags=["Task"], prefix="/dags/{dag_id}/tasks")
 
+_SORTABLE_TASK_FIELDS = {
+    "task_id",
+    "task_display_name",
+    "owner",
+    "start_date",
+    "end_date",
+    "trigger_rule",
+    "depends_on_past",
+    "wait_for_downstream",
+    "retries",
+    "queue",
+    "pool",
+    "pool_slots",
+    "execution_timeout",
+    "retry_delay",
+    "retry_exponential_backoff",
+    "priority_weight",
+    "weight_rule",
+    "ui_color",
+    "ui_fgcolor",
+    "operator_name",
+}
+
 
 @tasks_router.get(
     "",
@@ -52,10 +74,18 @@ def get_tasks(
 ) -> TaskCollectionResponse:
     """Get tasks for DAG."""
     dag = get_latest_version_of_dag(dag_bag, dag_id, session)
-    try:
-        tasks = sorted(dag.tasks, key=attrgetter(order_by.lstrip("-")), reverse=(order_by[0:1] == "-"))
-    except AttributeError as err:
-        raise HTTPException(status.HTTP_400_BAD_REQUEST, str(err))
+    lstripped_order_by = order_by.lstrip("-")
+    if lstripped_order_by not in _SORTABLE_TASK_FIELDS:
+        raise HTTPException(
+            status.HTTP_400_BAD_REQUEST,
+            f"Ordering with '{lstripped_order_by}' is disallowed or "
+            f"the attribute does not exist on the model",
+        )
+    tasks = sorted(
+        dag.tasks,
+        key=lambda task: (getattr(task, lstripped_order_by) is None, getattr(task, lstripped_order_by)),
+        reverse=(order_by[0:1] == "-"),
+    )
     return TaskCollectionResponse(
         tasks=cast("list[TaskResponse]", tasks),
         total_entries=len(tasks),

airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_tasks.py

@@ -543,10 +543,22 @@ def test_should_raise_400_for_invalid_order_by_name(self, test_client):
             f"{self.api_prefix}/{self.dag_id}/tasks?order_by=invalid_task_colume_name",
         )
         assert response.status_code == 400
-        assert (
-            response.json()["detail"] == "'EmptyOperator' object has no attribute 'invalid_task_colume_name'"
+        assert response.json()["detail"] == (
+            "Ordering with 'invalid_task_colume_name' is disallowed or "
+            "the attribute does not exist on the model"
         )
 
+    def test_should_respond_200_order_by_start_date_with_none(self, test_client):
+        """Sorting by a nullable field should not raise TypeError (issue #63927)."""
+        response = test_client.get(
+            f"{self.api_prefix}/{self.unscheduled_dag_id}/tasks?order_by=start_date",
+        )
+        assert response.status_code == 200
+        tasks = response.json()["tasks"]
+        assert len(tasks) == 2
+        # All start_dates are None for unscheduled tasks; verify they sort without error
+        assert all(t["start_date"] is None for t in tasks)
+
     def test_should_respond_404(self, test_client):
         dag_id = "xxxx_not_existing"
         response = test_client.get(f"{self.api_prefix}/{dag_id}/tasks")