The GitHub Actions job "Tests (AMD)" on 
airflow.git/validate-gcs-object-name-paths has succeeded.
Run started by GitHub user potiuk (triggered by potiuk).

Head commit for run:
e4f3049eaf6b4e41b32564aabb8bb236f977b050 / Jarek Potiuk <[email protected]>
gcs_to_sftp: allow relative destination_path roots

The post-join validation added in the previous commit rejected
benign uploads when ``destination_path`` was ``"."`` or ``""`` — both
of which are valid SFTP destinations referring to the user's
login / current directory. The startswith check on
``base.rstrip(os.sep) + os.sep`` evaluated to ``"./"`` for a
``"."`` base, and ``"file.txt"`` does not start with ``"./"``, so a
benign ``file.txt`` upload was misclassified as an escape.

Replace the single startswith check with three explicit conditions:

* a leading ``..`` segment after normalisation -> escapes any base;
* an absolute resolved path under a relative configured base ->
  ``source_object`` was itself absolute and absorbed the join;
* with an absolute base, the resolved path must stay within the
  base subtree.

Add regression tests covering ``destination_path="."`` and
``destination_path=""`` (allowed) as well as the same relative
base with a ``..`` escape or an absolute ``source_object``
(refused).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Report URL: https://github.com/apache/airflow/actions/runs/26655895062

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to