YoannAbriel opened a new pull request, #63296:
URL: https://github.com/apache/airflow/pull/63296
## Problem
`validate_key()` and `validate_run_id()` both allow `..` in their values.
Since `dag_id` and `run_id` are used in log file paths (e.g.
`dag_id=.../run_id=.../`), a crafted value containing `..` could theoretically
traverse outside the intended log directory.
## Root Cause
`KEY_REGEX` (`^[\w.-]+$`) matches `..` as valid consecutive dots.
`validate_run_id` uses a configurable `allowed_run_id_pattern` that could also
permit `..`. Neither function checks for path traversal sequences.
## Fix
Added an explicit `..` check in both `validate_key()` (raises
`AirflowException`) and `validate_run_id()` (raises `ValueError`) before any
other validation. Added corresponding unit tests for both functions.
Closes: #63295
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code
Generated-by: Claude Code following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
