Re: [PR] prevent path traversal in ObjectStoragePath recursive copy to local [airflow]

["Samin061 (via GitHub)" <gi...@apache.org>]

Samin061 commented on code in PR #69850:
URL: https://github.com/apache/airflow/pull/69850#discussion_r3756256383


##########
task-sdk/src/airflow/sdk/io/path.py:
##########
@@ -339,6 +340,25 @@ def size(self) -> int:
         """Size in bytes of the file at this path."""
         return self.fs.size(self.path)
 
+    def _raise_if_remote_keys_escape(self, local_dir: str, **kwargs) -> None:
+        """
+        Refuse a recursive download when a remote object key resolves outside ``local_dir``.
+
+        Object-store keys are arbitrary strings and may contain ``..`` segments written by
+        anyone who can put objects in the source prefix; ``fs.get`` follows them verbatim and
+        would write outside the destination directory.
+        """
+        dst_root = os.path.realpath(local_dir)
+        for src_key in self.fs.expand_path(self.path, recursive=True, **kwargs):
+            if self.fs.isdir(src_key):
+                continue

Review Comment:
   Good point, the doubled traversal was wasteful. Switched to fs.find(self.path), which returns files only, so the per-key isdir calls are gone and the guard walks the tree just once. Tests still green.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org