diff --git a/providers/sftp/src/airflow/providers/sftp/hooks/sftp.py b/providers/sftp/src/airflow/providers/sftp/hooks/sftp.py index 376aa01f8d010..e7ca19d2d66e3 100644 --- a/providers/sftp/src/airflow/providers/sftp/hooks/sftp.py +++ b/providers/sftp/src/airflow/providers/sftp/hooks/sftp.py @@ -718,19 +718,16 @@ def _parse_extras(self, conn: Connection) -> None: self.private_key = extra_options["private_key"] host_key = extra_options.get("host_key") - no_host_key_check = extra_options.get("no_host_key_check") - - if no_host_key_check is not None: - no_host_key_check = str(no_host_key_check).lower() == "true" - if host_key is not None and no_host_key_check: - raise ValueError("Host key check was skipped, but `host_key` value was given") - if no_host_key_check: - self.log.warning( - "No Host Key Verification. This won't protect against Man-In-The-Middle attacks" - ) - self.known_hosts = "none" + nhkc_raw = extra_options.get("no_host_key_check") + no_host_key_check = True if nhkc_raw is None else (str(nhkc_raw).lower() == "true") + + if host_key is not None and no_host_key_check: + raise ValueError("Host key check was skipped, but `host_key` value was given") - if host_key is not None: + if no_host_key_check: + self.log.warning("No Host Key Verification. This won't protect against Man-In-The-Middle attacks") + self.known_hosts = "none" + elif host_key is not None: self.known_hosts = f"{conn.host} {host_key}".encode() async def _get_conn(self) -> asyncssh.SSHClientConnection: diff --git a/providers/sftp/tests/unit/sftp/hooks/test_sftp.py b/providers/sftp/tests/unit/sftp/hooks/test_sftp.py index 33b4bdd103412..b7985566d182c 100644 --- a/providers/sftp/tests/unit/sftp/hooks/test_sftp.py +++ b/providers/sftp/tests/unit/sftp/hooks/test_sftp.py @@ -854,7 +854,7 @@ async def test_extra_dejson_fields_for_connection_building(self, mock_get_connec "username": "username", "password": "password", "client_keys": "~/keys/my_key", - "known_hosts": "~/.ssh/known_hosts", + "known_hosts": None, "passphrase": "mypassphrase", } @@ -882,6 +882,7 @@ async def test_connection_private(self, mock_get_connection, mock_import_private "username": "username", "password": "password", "client_keys": ["test"], + "known_hosts": None, "passphrase": "mypassphrase", }