[PR] quote remote job paths in posix ssh command builders [airflow]

["Samin061 (via GitHub)" <gi...@apache.org>]

Samin061 opened a new pull request, #70091:
URL: https://github.com/apache/airflow/pull/70091

   The POSIX builders in `remote_job.py` interpolate `RemoteJobPaths` values into single-quoted shell words without escaping, so a single quote anywhere in `remote_base_dir` closes the quote and the rest of the value is parsed as commands that run on the remote host as the SSH connection user. `remote_base_dir` is a template field, but `_validate_base_dir` runs in `__init__` against the un-rendered Jinja literal and never looks for shell metacharacters, so a value like `{{ dag_run.conf['dir'] }}` reaches the shell unchecked and someone who can only trigger a Dag run with config gets a shell on the target host. Quoting with `shlex.quote` at each site matches what the Windows builders already do via `ps_escape`.
   
   All six POSIX builders are affected. The `_validate_job_dir` prefix check on cleanup does not help, since a base dir that starts with `/tmp/airflow-ssh-jobs/` and then contains a quote still passes it:
   
   ```
   base_dir = "/tmp/airflow-ssh-jobs/x'; touch /tmp/pwned; :'"
   build_posix_cleanup_command(paths.job_dir)
   # rm -rf '/tmp/airflow-ssh-jobs/x'; touch /tmp/pwned; :'/job_123'
   ```
   
   Added a parametrized regression that runs each builder's output through `sh` and asserts the injected marker is never created; it fails on all six before this change.
   
   ---
   
   ##### Was generative AI tooling used to co-author this PR?
   
   - [X] Yes (please specify the tool below)
   
   Generated-by: Claude Code (Opus 4.8) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] quote remote job paths in posix ssh command builders [airflow]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #70091:
URL: https://github.com/apache/airflow/pull/70091


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org