Samin061 opened a new pull request, #68984: URL: https://github.com/apache/airflow/pull/68984
S3ToSFTPOperator and S3ToFTPOperator build the remote destination by concatenating S3 key suffixes returned by list_keys onto the configured sftp_path/ftp_path, so an object whose name contains ../ segments resolves outside that directory on the SFTP/FTP server and the upload lands wherever the server canonicalises it. Object names are arbitrary strings controlled by anyone who can write to the source bucket, so the resolved destination is validated to stay within the configured path before uploading, mirroring the existing gcs_to_sftp and gcs_to_samba guards. --- ##### Was generative AI tooling used to co-author this PR? - [ ] Yes (please specify the tool below) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
