Fix: Add path sanitization for api_environment to prevent path traversal

[K1nakoo]

What does this PR do?

This PR introduces a strict regex validation for the api_environment variable (populated via CLI arguments or AIRFLOW_CLI_ENVIRONMENT) within the Credentials class of airflowctl.

Why is this needed?

Currently, the environment name is directly passed to os.path.join(default_config_dir, f"{self.api_environment}.json") without any sanitization.
While airflowctl is a client tool, it is frequently executed in automated CI/CD pipelines where the environment variable might be populated dynamically (e.g., from a Git branch name or GitHub Actions runner). If an untrusted input containing directory traversal sequences (like ../../../tmp/evil) is passed, it could unintentionally write .json files outside the target configuration directory, leading to potential CI pipeline configuration overrides.

This patch enforces a Defense-in-Depth approach, ensuring that only valid, safe alphanumeric names (including dashes, periods, and underscores) are processed, completely mitigating the risk of path traversal.

Testing done

• Verified that valid environment names (e.g., production, dev.env-1) work as expected.
• Verified that providing a traversal payload (e.g., ../evil) correctly raises a ValueError and halts execution before any file system operations occur.

---

Was generative AI tooling used to co-author this PR?

• Yes (Gemini)

Generated-by: Gemini following the guidelines

[Srabasti]

Line 165 needs double quotes " instead of single quotes ' causing static checks to fail.
Please run prek locally and then push changes from branch to repo @K1nakoo !!

[potiuk]

@K1nakoo This PR has a few issues that need to be addressed before it can be reviewed — please see our Pull Request quality criteria.

Issues found:

• ❌ Pre-commit / static checks: Failing: CI image checks / Static checks. Run prek run --from-ref main locally to find and fix issues. See Pre-commit / static checks docs.

Note: Your branch is 24 commits behind main. Some check failures may be caused by changes in the base branch rather than by your PR. Please rebase your branch and push again to get up-to-date CI results.

What to do next:

• The comment informs you what you need to do.
• Fix each issue, then mark the PR as "Ready for review" in the GitHub UI - but only after making sure that all the issues are fixed.
• There is no rush — take your time and work at your own pace. We appreciate your contribution and are happy to wait for updates.
• Maintainers will then proceed with a normal review.

There is no rush — take your time and work at your own pace. We appreciate your contribution and are happy to wait for updates. If you have questions, feel free to ask on the Airflow Slack.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[SameerMesiah97]

Not a bad idea but it is too strict, which risks breaking existing deployments. Also, there are no tests at all. At minimum, I think you should cover both valid and invalid inputs.

[SameerMesiah97]

This is too strict. What about existing valid api_environment values like 'team:prod', or 'prod v2'?Previously this accepted any string, but now it is limited to , so these would fail. Since this comes from CLI/env, this could break real usages.

Seems like it would be better to loosen restriction to only block / and ..

[bugraoz93]

Could you please move your comment to the original PR? #63691

[bugraoz93]

#63691 duplicate