Samin061 commented on code in PR #69850:
URL: https://github.com/apache/airflow/pull/69850#discussion_r3756256383
##########
task-sdk/src/airflow/sdk/io/path.py:
##########
@@ -339,6 +340,25 @@ def size(self) -> int:
"""Size in bytes of the file at this path."""
return self.fs.size(self.path)
+ def _raise_if_remote_keys_escape(self, local_dir: str, **kwargs) -> None:
+ """
+ Refuse a recursive download when a remote object key resolves outside
``local_dir``.
+
+ Object-store keys are arbitrary strings and may contain ``..``
segments written by
+ anyone who can put objects in the source prefix; ``fs.get`` follows
them verbatim and
+ would write outside the destination directory.
+ """
+ dst_root = os.path.realpath(local_dir)
+ for src_key in self.fs.expand_path(self.path, recursive=True,
**kwargs):
+ if self.fs.isdir(src_key):
+ continue
Review Comment:
Good point, the doubled traversal was wasteful. Switched to
fs.find(self.path), which returns files only, so the per-key isdir calls are
gone and the guard walks the tree just once. Tests still green.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
