You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Samin061 (via GitHub)" <gi...@apache.org> on 2026/07/09 06:13:08 UTC
[PR] validate log server hostname before building the log fetch url [airflow]
Samin061 opened a new pull request, #69644:
URL: https://github.com/apache/airflow/pull/69644
When the api-server serves a task's logs it fetches them from the worker's log server at `http://{hostname}:{port}/log/...`, where `hostname` is whatever the worker reported for that task instance over the Execution API and was stored on the row unchanged. Nothing checks that value is a bare host before it is interpolated into the URL, so a hostname that carries URL syntax (for example `real-worker@attacker.host`, or a value with a path or scheme) breaks out of the host component and the request lands on a different host than intended. That request is not anonymous: `_fetch_logs_from_service` attaches a freshly signed `task-instance-logs` token and, by default, follows redirects, so the token can be delivered to an attacker-chosen host and a log-server redirect can bounce it further. I hit this while tracing where `ti.hostname` is written against where it is later trusted, and the two ends disagree on the value being a safe host. The fix validates the hostname against a bare-host
pattern inside `_get_log_retrieval_url` so an unexpected value yields no fetch URL at all, which covers both the worker and triggerer paths, and sets `allow_redirects=False` on the fetch so a signed request cannot be redirected off-host. Valid hostnames and IPs are unaffected.
---
##### Was generative AI tooling used to co-author this PR?
- [ ] Yes (please specify the tool below)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate log server hostname before building the log fetch url [airflow]
Posted by "Samin061 (via GitHub)" <gi...@apache.org>.
Samin061 commented on PR #69644:
URL: https://github.com/apache/airflow/pull/69644#issuecomment-5055745063
gentle ping
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate log server hostname before building the log fetch url [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #69644:
URL: https://github.com/apache/airflow/pull/69644#issuecomment-5839373117
Hello @Samin061 - thank you for your contributions to Apache Airflow!
The Airflow community has introduced a limit of **5 open pull requests at a time** for contributors without write access to the repository. You currently have 7 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:
* #69585 - Fix execution API 404 for connection IDs containing a slash
* #69644 - validate log server hostname before building the log fetch url
* #69850 - prevent path traversal in ObjectStoragePath recursive copy to local
* #71700 - escape connection type and field name in registry connection builder
* #71766 - restrict permissions on teradata credential files written for ssh runs
These pull requests stay open because maintainers are already engaged in them - they count towards your limit:
* #70000 - Strip connection headers on cross-host redirect in HttpHook
* #71423 - disable external entities in SAML idp response parsing
This is **not** a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.
What we ask you to do is to make your **first prioritization decision**: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or `gh pr reopen <PR_NUMBER> --repo apache/airflow`. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.
While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.
Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.
---
Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate log server hostname before building the log fetch url [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed pull request #69644: validate log server hostname before building the log fetch url
URL: https://github.com/apache/airflow/pull/69644
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org