The GitHub Actions job "Tests (AMD)" on airflow.git/backport-80f1ab4-v3-2-test 
has succeeded.
Run started by GitHub user vatsrahul1001 (triggered by vatsrahul1001).

Head commit for run:
a56c1b7049aee9af488e3881fe09b678b7b90e06 / Jarek Potiuk <[email protected]>
[v3-2-test] Tighten deserialization allowlist regex to require full-string 
match (#66499)

* Tighten deserialization allowlist regex to use full-string match

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``,
which only anchors at the start of the string. A pattern like
``airflow\.models\.Variable`` therefore also admitted classnames such as
``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the
admin's pattern matches the entire classname; document the semantics in
the config description so operators know to use ``.*`` for prefix-style
allowances.

* Add newsfragment for #66499

---------
(cherry picked from commit 80f1ab4d5a0f8b83873ce31f32b89d341f667b6f)

Co-authored-by: Jarek Potiuk <[email protected]>
Co-authored-by: Rahul Vats <[email protected]>

Report URL: https://github.com/apache/airflow/actions/runs/26024510767

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to