Samin061 opened a new pull request, #69850: URL: https://github.com/apache/airflow/pull/69850
ObjectStoragePath.copy() delegates a recursive remote-to-local transfer straight to fsspec's fs.get, so object keys containing .. segments (which anyone able to write to the source prefix controls) are followed verbatim and land outside the destination directory. Add a containment check on the recursive remote-to-local branch that expands the source keys and refuses any whose resolved local path escapes the destination, matching the guards already in the S3 and GCS sync_to_local_dir helpers. Non-recursive and same-store copies are untouched, so valid transfers behave exactly as before. --- ##### Was generative AI tooling used to co-author this PR? - [ ] Yes (please specify the tool below) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
