Samin061 commented on PR #69194: URL: https://github.com/apache/airflow/pull/69194#issuecomment-4912381326
Good notes. I folded in the O_NOFOLLOW open, so the write itself refuses a symlink planted in the check-then-open window rather than relying only on the islink pre-check. It falls back to a no-op where the flag doesn't exist (Windows), which lines up with the existing islink caveat there. You're right that the parent-directory case is separate: O_NOFOLLOW only guards the final component, so a name like `sub/evil` where `sub` is a pre-planted symlink still slips past both the islink check and the `../` escaping guard. Closing that means resolving the real path and verifying it stays under local_output_directory, which is a broader change than this fix. I'd rather keep this PR scoped to the race and handle the containment check as a follow-up, unless you'd prefer it folded in here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
