From c78687c82da9d1f5254fbb7c44b099e9a4a17f16 Mon Sep 17 00:00:00 2001
From: K1nako <105909793+K1nakoo@users.noreply.github.com>
Date: Mon, 16 Mar 2026 11:23:10 +0800
Subject: [PATCH 1/2] Add validation for API eFix: Add path sanitization for
 api_environment to prevent path traversalnvironment name

Validate the API environment name to allow only alphanumeric characters, dashes, and underscores.
---
 airflow-ctl/src/airflowctl/api/client.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/airflow-ctl/src/airflowctl/api/client.py b/airflow-ctl/src/airflowctl/api/client.py
index 0ef5d7cb16441..01c8a0ea6348b 100644
--- a/airflow-ctl/src/airflowctl/api/client.py
+++ b/airflow-ctl/src/airflowctl/api/client.py
@@ -22,6 +22,7 @@
 import getpass
 import json
 import logging
+import re
 import os
 import sys
 from collections.abc import Callable
@@ -160,7 +161,13 @@ def __init__(
     ):
         self.api_url = api_url
         self.api_token = api_token
-        self.api_environment = os.getenv("AIRFLOW_CLI_ENVIRONMENT") or api_environment
+        raw_env = os.getenv("AIRFLOW_CLI_ENVIRONMENT") or api_environment
+        if not re.match(r'^[a-zA-Z0-9_.-]+$', raw_env):
+            raise ValueError(
+                f"Invalid environment name: '{raw_env}'. "
+                "Only alphanumeric characters, dashes, and underscores are allowed."
+            )
+        self.api_environment = raw_env
         self.client_kind = client_kind
 
     @property

From ecbfd1fad732ff682b51a819a1805e504197e187 Mon Sep 17 00:00:00 2001
From: K1nako <105909793+K1nakoo@users.noreply.github.com>
Date: Tue, 17 Mar 2026 09:52:35 +0800
Subject: [PATCH 2/2] Fix regex pattern string formatting in client.py

---
 airflow-ctl/src/airflowctl/api/client.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/airflow-ctl/src/airflowctl/api/client.py b/airflow-ctl/src/airflowctl/api/client.py
index 01c8a0ea6348b..1e14fd29f8414 100644
--- a/airflow-ctl/src/airflowctl/api/client.py
+++ b/airflow-ctl/src/airflowctl/api/client.py
@@ -22,8 +22,8 @@
 import getpass
 import json
 import logging
-import re
 import os
+import re
 import sys
 from collections.abc import Callable
 from functools import wraps
@@ -162,7 +162,7 @@ def __init__(
         self.api_url = api_url
         self.api_token = api_token
         raw_env = os.getenv("AIRFLOW_CLI_ENVIRONMENT") or api_environment
-        if not re.match(r'^[a-zA-Z0-9_.-]+$', raw_env):
+        if not re.match(r"^[a-zA-Z0-9_.-]+$", raw_env):
             raise ValueError(
                 f"Invalid environment name: '{raw_env}'. "
                 "Only alphanumeric characters, dashes, and underscores are allowed."