[Andrushika]

Reject consecutive dots in Dag and task IDs in the Task SDK

Why

validate_key in the Task SDK does not block .. in Dag and task IDs. So DAG("a..b") and BaseOperator(task_id="a..b") are accepted, even when [core] allow_double_dot_in_ids is off. Core's validate_key already blocks this (added in #63296) to prevent path traversal, but the Task SDK has its own copy that never got the check.

What

This adds the same check to the Task SDK validate_key, using the same allow_double_dot_in_ids flag and default. Both validators now behave the same.

This issue was reported to the security team, which confirmed that there are no additional security concerns.

related: #63296

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude Opus 4.8 following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[Andrushika]

cc @YoannAbriel

[Andrushika]

Hi @potiuk, when you have a chance, could you please take a look at this PR? It addresses the issue we discussed in the security report email thread. Thanks!

[potiuk]

Hello @Andrushika - thank you for your contributions to Apache Airflow!

The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 7 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:

• Preserve AirflowTaskTimeout when timeout logging fails #69713 - Preserve AirflowTaskTimeout when timeout logging fails
• Fix mapped tasks does not validate task_id #70135 - Fix mapped tasks does not validate task_id
• Reject consecutive dots in Dag and task IDs in the Task SDK #70630 - Reject consecutive dots in Dag and task IDs in the Task SDK
• Enforce execution_timeout from the task supervisor #72493 - Enforce execution_timeout from the task supervisor
• Add breeze verify to list local checks for changed files #73241 - Add breeze verify to list local checks for changed files
• Add task state store API to the Java SDK #73464 - Add task state store API to the Java SDK

These pull requests stay open because maintainers are already engaged in them - they count towards your limit:

• Warn on suspicious Dag and task IDs at Java SDK build time #69937 - Warn on suspicious Dag and task IDs at Java SDK build time

This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.

What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or gh pr reopen <PR_NUMBER> --repo apache/airflow. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.

While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.

Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting