[variant] Using prepared project cache workdir: /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo
[variant] fake-gcs-server already present: /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/tools/fake-gcs-server
airflow 3.2.2
apache-airflow-providers-google 22.1.0
apache-airflow-providers-sftp 5.8.2
operator_file /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/venv_google_provider_22.1.0/lib/python3.14/site-packages/airflow/providers/google/cloud/transfers/gcs_to_sftp.py
airflow 3.2.2
apache-airflow-providers-google 22.2.1
apache-airflow-providers-sftp 5.8.2
operator_file /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/providers/google/cloud/transfers/gcs_to_sftp.py
[variant] === VULNERABLE PRODUCT VERSION (22.1.0) ===
[variant] Running symlink traversal candidate version=22.1.0 attempt=1
2026-07-06T09:46:53.438412Z [info     ] Unit test configuration loaded from 'unit_tests.cfg' [airflow.sdk.configuration] loc=configuration.py:205
2026-07-06T09:46:53.746656Z [warning  ] Skipping masking for a secret as it's too short (<5 chars) [airflow.sdk._shared.secrets_masker.secrets_masker] loc=secrets_masker.py:590
2026-07-06T09:46:53.751129Z [info     ] Executing copy of gs://variant-bucket/subdir/link/symlink_escape_1.txt to /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/vuln_variant/artifacts/symlink_variant_22.1.0_1/sftp_root/inbox/subdir/link/symlink_escape_1.txt [airflow.task.operators.airflow.providers.google.cloud.transfers.gcs_to_sftp.GCSToSFTPOperator] loc=gcs_to_sftp.py:189
2026-07-06T09:46:53.751299Z [warning  ] Remote Identification Change is not verified. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:292
2026-07-06T09:46:53.751362Z [warning  ] No Host Key Verification. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:302
2026-07-06T09:46:53.752787Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.753029Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.797312Z [info     ] Auth granted (password).       [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.797713Z [info     ] Authentication (password) successful! [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.799980Z [info     ] [chan 0] Opened sftp connection (server version 3) [paramiko.transport.sftp] loc=sftp.py:169
2026-07-06T09:46:53.800612Z [info     ] /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/vuln_variant/artifacts/symlink_variant_22.1.0_1/sftp_root/inbox/subdir/link already exists [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=sftp.py:298
2026-07-06T09:46:53.800698Z [info     ] [chan 0] sftp session closed.  [paramiko.transport.sftp] loc=sftp.py:169
2026-07-06T09:46:53.802250Z [error    ] Socket exception: Connection reset by peer (104) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.829317Z [info     ] File downloaded to /tmp/tmpqtmbsxqw [airflow.task.hooks.airflow.providers.google.cloud.hooks.gcs.GCSHook] loc=gcs.py:385
2026-07-06T09:46:53.829454Z [warning  ] Remote Identification Change is not verified. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:292
2026-07-06T09:46:53.829510Z [warning  ] No Host Key Verification. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:302
2026-07-06T09:46:53.830520Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.830812Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.833708Z [info     ] Auth granted (password).       [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.833890Z [info     ] Authentication (password) successful! [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:53.835222Z [info     ] [chan 0] Opened sftp connection (server version 3) [paramiko.transport.sftp] loc=sftp.py:169
2026-07-06T09:46:53.836699Z [info     ] [chan 0] sftp session closed.  [paramiko.transport.sftp] loc=sftp.py:169
2026-07-06T09:46:53.837009Z [info     ] Done. Uploaded '1' files to /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/vuln_variant/artifacts/symlink_variant_22.1.0_1/sftp_root/inbox [airflow.task.operators.airflow.providers.google.cloud.transfers.gcs_to_sftp.GCSToSFTPOperator] loc=gcs_to_sftp.py:167
2026-07-06T09:46:53.837207Z [error    ] Socket exception: Connection reset by peer (104) [paramiko.transport] loc=transport.py:1944
[variant] === FIXED PRODUCT VERSION (22.2.1) ===
[variant] Running symlink traversal candidate version=22.2.1 attempt=1
2026-07-06T09:46:56.183121Z [info     ] Unit test configuration loaded from 'unit_tests.cfg' [airflow.sdk.configuration] loc=configuration.py:205
2026-07-06T09:46:56.502964Z [warning  ] Skipping masking for a secret as it's too short (<5 chars) [airflow.sdk._shared.secrets_masker.secrets_masker] loc=secrets_masker.py:590
2026-07-06T09:46:56.506587Z [info     ] Executing copy of gs://variant-bucket/subdir/link/symlink_escape_1.txt to /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/vuln_variant/artifacts/symlink_variant_22.2.1_1/sftp_root/inbox/subdir/link/symlink_escape_1.txt [airflow.task.operators.airflow.providers.google.cloud.transfers.gcs_to_sftp.GCSToSFTPOperator] loc=gcs_to_sftp.py:210
2026-07-06T09:46:56.506698Z [warning  ] Remote Identification Change is not verified. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:292
2026-07-06T09:46:56.506765Z [warning  ] No Host Key Verification. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:302
2026-07-06T09:46:56.507504Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.507708Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.552240Z [info     ] Auth granted (password).       [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.552575Z [info     ] Authentication (password) successful! [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.554154Z [info     ] [chan 0] Opened sftp connection (server version 3) [paramiko.transport.sftp] loc=sftp.py:169
2026-07-06T09:46:56.554640Z [info     ] /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/vuln_variant/artifacts/symlink_variant_22.2.1_1/sftp_root/inbox/subdir/link already exists [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=sftp.py:298
2026-07-06T09:46:56.554729Z [info     ] [chan 0] sftp session closed.  [paramiko.transport.sftp] loc=sftp.py:169
2026-07-06T09:46:56.555360Z [error    ] Socket exception: Connection reset by peer (104) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.582717Z [info     ] File downloaded to /tmp/tmp5te3zh2z [airflow.task.hooks.airflow.providers.google.cloud.hooks.gcs.GCSHook] loc=gcs.py:385
2026-07-06T09:46:56.582874Z [warning  ] Remote Identification Change is not verified. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:292
2026-07-06T09:46:56.582921Z [warning  ] No Host Key Verification. This won't protect against Man-In-The-Middle attacks [airflow.task.hooks.airflow.providers.sftp.hooks.sftp.SFTPHook] loc=ssh.py:302
2026-07-06T09:46:56.583838Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.584238Z [info     ] Connected (version 2.0, client paramiko_3.5.1) [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.586801Z [info     ] Auth granted (password).       [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.586954Z [info     ] Authentication (password) successful! [paramiko.transport] loc=transport.py:1944
2026-07-06T09:46:56.587964Z [info     ] [chan 0] Opened sftp connection (server version 3) [paramiko.transport.sftp] loc=sftp.py:169
2026-07-06T09:46:56.589287Z [info     ] [chan 0] sftp session closed.  [paramiko.transport.sftp] loc=sftp.py:169
2026-07-06T09:46:56.589559Z [info     ] Done. Uploaded '1' files to /data/pruva/runs/d858a813-a9e9-431a-85df-e8630e0b506e/bundle/vuln_variant/artifacts/symlink_variant_22.2.1_1/sftp_root/inbox [airflow.task.operators.airflow.providers.google.cloud.transfers.gcs_to_sftp.GCSToSFTPOperator] loc=gcs_to_sftp.py:167
2026-07-06T09:46:56.589765Z [error    ] Socket exception: Connection reset by peer (104) [paramiko.transport] loc=transport.py:1944
[variant] === Evaluating symlink traversal candidate ===
[variant] vulnerable_exploited=True
[variant] fixed_exploited=True
[variant] fixed_exception=None: None
[variant] RESULT: confirmed fixed-version bypass (exit 0)