-
Notifications
You must be signed in to change notification settings - Fork 4.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[bitnami/airflow] Escape special characters in Airflow LDAP configuration values #66534
Conversation
…ingle quotes are escaped correctly in webserver_config.py Signed-off-by: Zane Geiger <[email protected]>
831cdfa
to
ec3b201
Compare
Should this and #66535 each be broken up into three separate PRs for It seems that the CI pipeline skipped checks since this modifies multiple containers at once. Also, the link to container best practices in |
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
Sorry for the late reply, @zanecodes. It's fine like this. |
Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks so much for this contribution and sorry for the big delay in the review process! LGTM
New releases including your changes now available:
|
Description of the change
This change fixes #65217 by escaping single quotes and backslashes in
AIRFLOW_LDAP_
configuration values that are interpolated intowebserver_config.py
as Python strings.However, values that are not interpolated as strings such as
AIRFLOW_LDAP_ROLES_MAPPING
,AIRFLOW_LDAP_ROLES_SYNC_AT_LOGIN
, andAIRFLOW_LDAP_ALLOW_SELF_SIGNED
are still susceptible to arbitrary Python injection.Benefits
AIRFLOW_LDAP_
configuration values that are interpolated as Python strings (e.g.AIRFLOW_LDAP_BIND_PASSWORD
) may now contain single quotes and backslashes, and the Airflow container will handle them correctly instead of erroring out on startup.Possible drawbacks
If for some reason this behavior was being abused by users to inject arbitrary Python into
webserver_config.py
, that will no longer work; they should instead mount their ownwebserver_config.py
into the container.Applicable issues
AIRFLOW_LDAP_
environment variable contains a single quote #65217