The GitHub Actions job "Tests (AMD)" on airflow.git/validate-gcs-object-name-paths has succeeded. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: fd6f42fba143cfa29d85cd9c17169d83ff6e7aa8 / Jarek Potiuk <[email protected]> Validate destination paths derived from GCS object names GCSToSFTPOperator._resolve_destination_path computes the SFTP destination by joining the GCS object name onto destination_path. GCS object names are arbitrary UTF-8 strings controlled by whoever can write to the source bucket, so a name with ".." segments or an absolute prefix could canonicalise outside the configured destination and land somewhere like ~/.ssh/authorized_keys on the SFTP host. Normalise the joined path and require it to stay within the configured base — for absolute and relative bases alike, skipping only "." / "" (the SFTP login directory, where any non-escaping relative path is already in-bounds). On a violation raise ValueError identifying the offending object name. The sibling GCSTimeSpanFileTransformOperator._download path was already hardened separately in #67509. Report URL: https://github.com/apache/airflow/actions/runs/27662797367 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
