You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "YoannAbriel (via GitHub)" <gi...@apache.org> on 2026/03/10 20:07:43 UTC
[PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
YoannAbriel opened a new pull request, #63296:
URL: https://github.com/apache/airflow/pull/63296
## Problem
`validate_key()` and `validate_run_id()` both allow `..` in their values. Since `dag_id` and `run_id` are used in log file paths (e.g. `dag_id=.../run_id=.../`), a crafted value containing `..` could theoretically traverse outside the intended log directory.
## Root Cause
`KEY_REGEX` (`^[\w.-]+$`) matches `..` as valid consecutive dots. `validate_run_id` uses a configurable `allowed_run_id_pattern` that could also permit `..`. Neither function checks for path traversal sequences.
## Fix
Added an explicit `..` check in both `validate_key()` (raises `AirflowException`) and `validate_run_id()` (raises `ValueError`) before any other validation. Added corresponding unit tests for both functions.
Closes: #63295
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code
Generated-by: Claude Code following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #63296:
URL: https://github.com/apache/airflow/pull/63296#issuecomment-4115685939
> I wonder if we might want to make and import a constant like DOUBLE_DOT - ".." rather than littering magic strings around, but I'm fine with it as-is... that may be overkill.
Yeah.. It's longer than ".." and `DOUBLE_DOT` constant is unlikely to change to something else (like "..." to justify DRY).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #63296:
URL: https://github.com/apache/airflow/pull/63296
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #63296:
URL: https://github.com/apache/airflow/pull/63296#discussion_r2979291518
##########
airflow-core/newsfragments/63296.significant.rst:
##########
@@ -0,0 +1,16 @@
+Block path traversal via ``..`` in ``dag_id`` and ``run_id``
Review Comment:
It is a signficant change for some, worth calling it out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "ferruzzi (via GitHub)" <gi...@apache.org>.
ferruzzi commented on code in PR #63296:
URL: https://github.com/apache/airflow/pull/63296#discussion_r2976351302
##########
airflow-core/src/airflow/config_templates/config.yml:
##########
@@ -439,6 +439,16 @@ core:
example: ~
default: "1024"
+ allow_dotdot_in_ids:
Review Comment:
I'm terrible at naming things, but that.... that could be better 😆
consider `allow_double_dot_in_ids` or `allow_consecutive_dots_in_ids` (that's so long...) or maybe invert it and call if something like `check_id_path_safety`??
I don't know. `dotdot` sounds awkward though
##########
airflow-core/src/airflow/config_templates/config.yml:
##########
@@ -439,6 +439,16 @@ core:
example: ~
default: "1024"
+ allow_dotdot_in_ids:
+ description: |
+ Allow ``..`` (consecutive dots) in DAG IDs and run IDs. By default, ``..`` is blocked to prevent
+ path traversal attacks. Set to ``True`` only if you have existing DAGs or runs whose IDs contain
+ ``..`` and cannot be renamed.
+ version_added: 3.0.0
Review Comment:
This would be released in 3.3.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "ferruzzi (via GitHub)" <gi...@apache.org>.
ferruzzi commented on PR #63296:
URL: https://github.com/apache/airflow/pull/63296#issuecomment-4034812667
Since this is a breaking change, it will also need a newsfragment
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "YoannAbriel (via GitHub)" <gi...@apache.org>.
YoannAbriel commented on PR #63296:
URL: https://github.com/apache/airflow/pull/63296#issuecomment-4034739284
Good point — will add a config flag (default: block) so existing users with `..` in IDs aren't broken. Will update the PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "YoannAbriel (via GitHub)" <gi...@apache.org>.
YoannAbriel commented on code in PR #63296:
URL: https://github.com/apache/airflow/pull/63296#discussion_r2977012519
##########
airflow-core/src/airflow/config_templates/config.yml:
##########
@@ -439,6 +439,16 @@ core:
example: ~
default: "1024"
+ allow_dotdot_in_ids:
Review Comment:
Renamed to `allow_double_dot_in_ids`, bumped version_added to 3.3.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #63296:
URL: https://github.com/apache/airflow/pull/63296#issuecomment-4034251567
cc: @ferruzzi -> did you think how to handle the case if someone already uses `..` ? I do not think this "Weak" possible issue is worth the risk ? WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "ferruzzi (via GitHub)" <gi...@apache.org>.
ferruzzi commented on PR #63296:
URL: https://github.com/apache/airflow/pull/63296#issuecomment-4034463911
I'm not honestly sure how big of a risk it is, in the end, but it did seem like a reasonable concern. IMHO, we can have a flag to allow it, set to false. That way we're "safe by default" and the user has to explicitly allow it? It's still breaking, but with some allowance??
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: block path traversal via ".." in dag_id and run_id [airflow]
Posted by "ferruzzi (via GitHub)" <gi...@apache.org>.
ferruzzi commented on code in PR #63296:
URL: https://github.com/apache/airflow/pull/63296#discussion_r2943674667
##########
airflow-core/newsfragments/63296.significant.rst:
##########
@@ -0,0 +1,16 @@
+Block path traversal via ``..`` in ``dag_id`` and ``run_id``
Review Comment:
@potiuk - What do you think, does this count as a `significant` or should it be a bugfix one-liner?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org