You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/04/16 02:50:29 UTC
[PR] Validate SMTP server certificate on STARTTLS upgrade [airflow]
potiuk opened a new pull request, #65346:
URL: https://github.com/apache/airflow/pull/65346
## Summary
`smtplib.SMTP.starttls()` does not validate the server certificate unless an SSL context is passed. `airflow.utils.email.send_mime_email` and the SMTP provider's `SmtpHook` (both sync `get_conn` and async `aget_conn`) were calling `starttls()` without a context, so the STARTTLS upgrade skipped certificate validation.
This PR passes the existing SSL-context machinery to `starttls()` at all three call sites:
- **`airflow-core/src/airflow/utils/email.py`** — factored the SSL-context lookup out of `_get_smtp_connection` into a helper `_get_ssl_context()`, driven by the existing `email.ssl_context` config. The helper is now called by both the `SMTP_SSL` path and the new STARTTLS path.
- **`providers/smtp/src/airflow/providers/smtp/hooks/smtp.py`** — factored the SSL-context lookup into `_build_ssl_context()`, driven by the existing `ssl_context` connection extra. The helper is called for `SMTP_SSL` (sync), for `aiosmtplib.SMTP` construction (async), and for the explicit `starttls()` calls in both `get_conn` and `aget_conn`.
### Default behaviour change
The default SSL context is now `ssl.create_default_context()`, which validates against the system's trusted CAs. Environments that intentionally use self-signed or otherwise non-validating SMTP servers can opt out:
- Core: set `email.ssl_context = "none"` in `airflow.cfg`
- Provider: set `ssl_context: "none"` in the SMTP connection extras
The opt-out already existed for the SMTP_SSL path; it now applies to the STARTTLS path too.
## Test plan
- [x] `airflow-core/tests/unit/utils/test_email.py` — 25/25 pass
- [x] `providers/smtp/tests/unit/smtp/hooks/test_smtp.py` — 34/34 pass (including sync `test_ehlo_called_after_starttls` and async `test_async_connection` updated to verify `starttls` is invoked with an `ssl.SSLContext`)
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 4.6 (1M context)
Generated-by: Claude Opus 4.6 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Validate SMTP server certificate on STARTTLS upgrade [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #65346:
URL: https://github.com/apache/airflow/pull/65346#issuecomment-4259143197
### Backport successfully created: v3-2-test
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-2-test</td>
<td><a href="https://github.com/apache/airflow/pull/65364"><img src="https://img.shields.io/badge/PR-65364-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Validate SMTP server certificate on STARTTLS upgrade [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on code in PR #65346:
URL: https://github.com/apache/airflow/pull/65346#discussion_r3090597706
##########
airflow-core/newsfragments/65346.significant.rst:
##########
@@ -0,0 +1,3 @@
+The SMTP STARTTLS upgrade performed by ``airflow.utils.email.send_email`` now validates the SMTP server's certificate against the system's trusted CA bundle by default. Previously the ``starttls()`` call was made without an SSL context, so any certificate was accepted.
Review Comment:
I thought this function was fully migrated to providers?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Validate SMTP server certificate on STARTTLS upgrade [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #65346:
URL: https://github.com/apache/airflow/pull/65346#discussion_r3090612806
##########
airflow-core/newsfragments/65346.significant.rst:
##########
@@ -0,0 +1,3 @@
+The SMTP STARTTLS upgrade performed by ``airflow.utils.email.send_email`` now validates the SMTP server's certificate against the system's trusted CA bundle by default. Previously the ``starttls()`` call was made without an SSL context, so any certificate was accepted.
Review Comment:
It's not.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Validate SMTP server certificate on STARTTLS upgrade [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #65346:
URL: https://github.com/apache/airflow/pull/65346#issuecomment-4259140688
Hi maintainer, this PR was merged without a milestone set.
We've automatically set the milestone to **[Airflow 3.2.2](https://github.com/apache/airflow/milestone/138)** based on: backport label targeting v3-2-test
If this milestone is not correct, please update it to the appropriate milestone.
> This comment was generated by [Milestone Tag Assistant](https://github.com/apache/airflow/blob/main/.github/workflows/milestone-tag-assistant.yml).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Validate SMTP server certificate on STARTTLS upgrade [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #65346:
URL: https://github.com/apache/airflow/pull/65346
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org