You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Samin061 (via GitHub)" <gi...@apache.org> on 2026/07/22 06:43:21 UTC
[PR] reject backslash-after-scheme urls in is_safe_url [airflow]
Samin061 opened a new pull request, #70215:
URL: https://github.com/apache/airflow/pull/70215
`is_safe_url` in `airflow-core/src/airflow/api_fastapi/core_api/security.py` rejects a leading `//`, `/\`, `\/` and `\\`, but not a backslash that follows the scheme, so `https:\\evil.com` is parsed by urllib as a relative path, `urljoin` re-attaches the base netloc, and the netloc comparison passes. Browsers follow WHATWG, where `\` is `/` for special schemes, so the same string navigates to `https://evil.com` — `GET /auth/token/login?next=https:\\evil.com` returns it verbatim as the redirect location and `GET /auth/login?next=` forwards it to the auth manager login page, both without authentication. Normalising backslashes to forward slashes before the prefix check and the parse makes the helper agree with the parser that actually resolves the value; the second `unquote` goes away with it so the guard and the resolution look at the same string.
---
##### Was generative AI tooling used to co-author this PR?
- [ ] Yes (please specify the tool below)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] reject backslash-after-scheme urls in is_safe_url [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun merged PR #70215:
URL: https://github.com/apache/airflow/pull/70215
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] reject backslash-after-scheme urls in is_safe_url [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #70215:
URL: https://github.com/apache/airflow/pull/70215#issuecomment-5090234136
### Backport successfully created: v3-3-test
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-3-test</td>
<td><a href="https://github.com/apache/airflow/pull/70515"><img src="https://img.shields.io/badge/PR-70515-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] reject backslash-after-scheme urls in is_safe_url [airflow]
Posted by "Samin061 (via GitHub)" <gi...@apache.org>.
Samin061 commented on PR #70215:
URL: https://github.com/apache/airflow/pull/70215#issuecomment-5263807404
Thanks for the review and merge, glad this one landed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] reject backslash-after-scheme urls in is_safe_url [airflow]
Posted by "Samin061 (via GitHub)" <gi...@apache.org>.
Samin061 commented on PR #70215:
URL: https://github.com/apache/airflow/pull/70215#issuecomment-5391628522
Tested against 3.3.1rc1. The fix is in via the v3-3-test backport (#70515): `https:\\evil.com`, `https:/\evil.com`, `https:\/evil.com` and the percent-encoded `https%3A%5C%5Cevil.com` all return False against the default base URL, while same-origin paths like `/dags` and `dags/x` still resolve as safe. Working as expected for me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org