[bitnami/airflow] Escape special characters in Airflow LDAP configuration values #66534
Conversation
…ingle quotes are escaped correctly in webserver_config.py Signed-off-by: Zane Geiger <[email protected]>
zanecodes
force-pushed
the
airflow-escape-ldap
branch
from
831cdfa
to
ec3b201
Compare
carrodher
added
verify
|
Should this and #66535 each be broken up into three separate PRs for It seems that the CI pipeline skipped checks since this modifies multiple containers at once. Also, the link to container best practices in |
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
|
Sorry for the late reply, @zanecodes. It's fine like this. |
|
Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
|
Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
|
Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
|
New releases including your changes now available:
|
Description of the change
This change fixes #65217 by escaping single quotes and backslashes in
AIRFLOW_LDAP_configuration values that are interpolated intowebserver_config.pyas Python strings.However, values that are not interpolated as strings such as
AIRFLOW_LDAP_ROLES_MAPPING,AIRFLOW_LDAP_ROLES_SYNC_AT_LOGIN, andAIRFLOW_LDAP_ALLOW_SELF_SIGNEDare still susceptible to arbitrary Python injection.Benefits
AIRFLOW_LDAP_configuration values that are interpolated as Python strings (e.g.AIRFLOW_LDAP_BIND_PASSWORD) may now contain single quotes and backslashes, and the Airflow container will handle them correctly instead of erroring out on startup.Possible drawbacks
If for some reason this behavior was being abused by users to inject arbitrary Python into
webserver_config.py, that will no longer work; they should instead mount their ownwebserver_config.pyinto the container.Applicable issues
AIRFLOW_LDAP_environment variable contains a single quote #65217