{
  "version": "22.2.1",
  "attempt": 2,
  "entrypoint": "airflow tasks test cve_2026_49297_repro_dag copy_malicious_gcs_object_to_sftp",
  "dag_file": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/airflow_home/dags/cve_2026_49297_repro_dag.py",
  "fake_gcs_endpoint": "http://127.0.0.1:46663",
  "fake_gcs_log": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/fake_gcs_server.log",
  "gcs_api_trace": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/gcs_api_trace.json",
  "gcs_seed_ok": true,
  "source_bucket": "malicious-bucket",
  "source_object": "subdir/*",
  "gcs_listed_object": "subdir/../../escaped_2.txt",
  "destination_path": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/sftp_root/inbox",
  "sftp_port": 35583,
  "sftp_accepted_connections": 0,
  "escaped_file": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/sftp_root/escaped_2.txt",
  "escaped_file_exists": false,
  "escaped_file_content": null,
  "file_inside_destination": false,
  "airflow_task_returncode": 0,
  "airflow_task_log": "/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/airflow_tasks_test.log",
  "airflow_task_stdout_excerpt": "dagrun.py:2223\n2026-07-06T09:35:42.611488Z [info     ] [DAG TEST] starting task_id=copy_malicious_gcs_object_to_sftp map_index=-1 [airflow.sdk.definitions.dag] loc=dag.py:1435\n2026-07-06T09:35:42.611728Z [info     ] [DAG TEST] running task <TaskInstance: cve_2026_49297_repro_dag.copy_malicious_gcs_object_to_sftp __airflow_temporary_run_2026-07-06T09:35:42.591908+00:00__ [None] ti_id=019f36c8-9408-73a7-a6a8-d480bb937cb6> [airflow.sdk.definitions.dag] loc=dag.py:1438\n2026-07-06T09:35:44.156676Z [info     ] Task started                   [airflow.api_fastapi.execution_api.routes.task_instances] correlation_id=019f36c8-953c-73b4-bec1-bda82100af10 hostname=974542b9802b loc=task_instances.py:216 previous_state=queued ti_id=019f36c8-9408-73a7-a6a8-d480bb937cb6\n2026-07-06T09:35:44.157989Z [info     ] Task instance state updated    [airflow.api_fastapi.execution_api.routes.task_instances] correlation_id=019f36c8-953c-73b4-bec1-bda82100af10 loc=task_instances.py:242 rows_affected=1 ti_id=019f36c8-9408-73a7-a6a8-d480bb937cb6\n2026-07-06T09:35:44.182467Z [info     ] Updating RenderedTaskInstanceFields [airflow.api_fastapi.execution_api.routes.task_instances] correlation_id=019f36c8-9a33-7df7-9229-679c36c2df63 field_count=4 loc=task_instances.py:828 ti_id=019f36c8-9408-73a7-a6a8-d480bb937cb6\n2026-07-06T09:35:44.197375Z [info     ] ::endgroup::                   [task] loc=task_runner.py:1727\n2026-07-06T09:35:44.198129Z [warning  ] Skipping masking for a secret as it's too short (<5 chars) [airflow.sdk._shared.secrets_masker.secrets_masker] loc=secrets_masker.py:590\n2026-07-06T09:35:44.201710Z [error    ] Task failed with exception     [task] loc=task_runner.py:1381\nTraceback (most recent call last):\n  File \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/sdk/execution_time/task_runner.py\", line 1287, in run\n    result = _execute_task(context=context, ti=ti, log=log)\n  File \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/sdk/execution_time/task_runner.py\", line 1745, in _execute_task\n    result = ctx.run(execute, context=context)\n  File \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/sdk/bases/operator.py\", line 443, in wrapper\n    return func(self, *args, **kwargs)\n  File \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/providers/google/cloud/transfers/gcs_to_sftp.py\", line 164, in execute\n    destination_path = self._resolve_destination_path(source_object, prefix=prefix_dirname)\n  File \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/providers/google/cloud/transfers/gcs_to_sftp.py\", line 196, in _resolve_destination_path\n    raise ValueError(\n    ...<2 lines>...\n    )\nValueError: Refusing to copy GCS object 'subdir/../../escaped_2.txt': resolved destination '/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/sftp_root/escaped_2.txt' escapes configured destination_path '/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/sftp_root/inbox'.\n2026-07-06T09:35:44.202543Z [info     ] ::group::Post Execute          [task] loc=task_runner.py:1382\n2026-07-06T09:35:44.202702Z [info     ] ::endgroup::                   [task] loc=task_runner.py:1896\n2026-07-06T09:35:44.211497Z [info     ] Task instance state updated    [airflow.api_fastapi.execution_api.routes.task_instances] correlation_id=019f36c8-9a4a-7048-8128-df5bdf17af21 loc=task_instances.py:432 new_state=failed rows_affected=1 ti_id=019f36c8-9408-73a7-a6a8-d480bb937cb6\n2026-07-06T09:35:44.226182Z [info     ] [DAG TEST] end task task_id=copy_malicious_gcs_object_to_sftp map_index=-1 [airflow.sdk.definitions.dag] loc=dag.py:1497\n",
  "error": "10ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/sdk/execution_time/task_runner.py\", line 1745, in _execute_task\n    result = ctx.run(execute, context=context)\n  File \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/sdk/bases/operator.py\", line 443, in wrapper\n    return func(self, *args, **kwargs)\n  File \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/providers/google/cloud/transfers/gcs_to_sftp.py\", line 164, in execute\n    destination_path = self._resolve_destination_path(source_object, prefix=prefix_dirname)\n  File \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/providers/google/cloud/transfers/gcs_to_sftp.py\", line 196, in _resolve_destination_path\n    raise ValueError(\n    ...<2 lines>...\n    )\nValueError: Refusing to copy GCS object 'subdir/../../escaped_2.txt': resolved destination '/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/sftp_root/escaped_2.txt' escapes configured destination_path '/data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/artifacts/product_test_22.2.1_2/sftp_root/inbox'.\n2026-07-06T09:35:44.202543Z [info     ] ::group::Post Execute          [task] loc=task_runner.py:1382\n2026-07-06T09:35:44.202702Z [info     ] ::endgroup::                   [task] loc=task_runner.py:1896\n2026-07-06T09:35:44.211497Z [info     ] Task instance state updated    [airflow.api_fastapi.execution_api.routes.task_instances] correlation_id=019f36c8-9a4a-7048-8128-df5bdf17af21 loc=task_instances.py:432 new_state=failed rows_affected=1 ti_id=019f36c8-9408-73a7-a6a8-d480bb937cb6\n2026-07-06T09:35:44.226182Z [info     ] [DAG TEST] end task task_id=copy_malicious_gcs_object_to_sftp map_index=-1 [airflow.sdk.definitions.dag] loc=dag.py:1497\n",
  "exception_type": "ValueError",
  "target_reached": true,
  "sftp_operations": []
}