orbisai0security commented on PR #67630: URL: https://github.com/apache/airflow/pull/67630#issuecomment-4569516745
> I do not know if this is a real concern, if you have access to the environment you can be very harmful by nature so I really dont know if this is worth the effort Thanks, that’s a fair point. I agree this is not attacker-controlled in a normal Airflow deployment, and I should not frame it as a high-severity/remote LDAP injection issue. The concern I was trying to address is narrower: `AUTH_LDAP_SEARCH_FILTER` is a security-sensitive configuration value that is later interpolated into an LDAP query. In some deployments, this value may be generated from Helm values, env vars, config management, or other automation rather than being hand-written directly by an Airflow admin. A small validation step can help fail fast on malformed filters and make misconfiguration safer/easier to diagnose. That said, I understand if this is not worth carrying as-is. I can rework the PR as low-severity defensive hardening by: - removing the unrelated `flash(Markup(...))` change; - changing the description to avoid claiming direct exploitability; - replacing the broad generated-style test with a small focused test around the actual LDAP filter construction path; - keeping the validation minimal and compatibility-conscious. Would that framing make this more reasonable? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
