Skip to content

Fix: Add path sanitization for api_environment to prevent path traversal #63708

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
K1nakoo wants to merge 4 commits into from
Closed

Fix: Add path sanitization for api_environment to prevent path traversal #63708

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c78687c
Add validation for API eFix: Add path sanitization for api_environmen…
K1nakoo Mar 16, 2026
d523b37
Merge branch 'main' into K1nakoo-patch-1
K1nakoo Mar 16, 2026
ea987f5
Reorder import statements in client.py
K1nakoo Mar 16, 2026
bb12fae
Merge branch 'main' into K1nakoo-patch-2
K1nakoo Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion airflow-ctl/src/airflowctl/api/client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import json
import logging
import os
import re
import sys
from collections.abc import Callable
from functools import wraps
Expand Down Expand Up @@ -160,7 +161,13 @@ def __init__(
):
self.api_url = api_url
self.api_token = api_token
self.api_environment = os.getenv("AIRFLOW_CLI_ENVIRONMENT") or api_environment
raw_env = os.getenv("AIRFLOW_CLI_ENVIRONMENT") or api_environment
if not re.match(r'^[a-zA-Z0-9_.-]+$', raw_env):

@SameerMesiah97 SameerMesiah97 Mar 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is too strict. What about existing valid api_environment values like 'team:prod', or 'prod v2'?Previously this accepted any string, but now it is limited to , so these would fail. Since this comes from CLI/env, this could break real usages.

Seems like it would be better to loosen restriction to only block / and ..

@bugraoz93 bugraoz93 Apr 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you please move your comment to the original PR? #63691

raise ValueError(
f"Invalid environment name: '{raw_env}'. "
"Only alphanumeric characters, dashes, and underscores are allowed."
)
self.api_environment = raw_env
self.client_kind = client_kind

@property
Expand Down
Loading