Samin061 opened a new pull request, #70091:
URL: https://github.com/apache/airflow/pull/70091
The POSIX builders in `remote_job.py` interpolate `RemoteJobPaths` values
into single-quoted shell words without escaping, so a single quote anywhere in
`remote_base_dir` closes the quote and the rest of the value is parsed as
commands that run on the remote host as the SSH connection user.
`remote_base_dir` is a template field, but `_validate_base_dir` runs in
`__init__` against the un-rendered Jinja literal and never looks for shell
metacharacters, so a value like `{{ dag_run.conf['dir'] }}` reaches the shell
unchecked and someone who can only trigger a Dag run with config gets a shell
on the target host. Quoting with `shlex.quote` at each site matches what the
Windows builders already do via `ps_escape`.
All six POSIX builders are affected. The `_validate_job_dir` prefix check on
cleanup does not help, since a base dir that starts with
`/tmp/airflow-ssh-jobs/` and then contains a quote still passes it:
```
base_dir = "/tmp/airflow-ssh-jobs/x'; touch /tmp/pwned; :'"
build_posix_cleanup_command(paths.job_dir)
# rm -rf '/tmp/airflow-ssh-jobs/x'; touch /tmp/pwned; :'/job_123'
```
Added a parametrized regression that runs each builder's output through `sh`
and asserts the injected marker is never created; it fails on all six before
this change.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (Opus 4.8) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
