[GitHub] [airflow] raajpackt edited a comment on pull request #15599: Mask passwords and sensitive info in task logs and UI

[GitBox <gi...@apache.org>]

raajpackt edited a comment on pull request #15599:
URL: https://github.com/apache/airflow/pull/15599#issuecomment-866872958


   Airflow DAG Task log file.
   `[2021-06-23 14:03:11,403] {subprocess.py:79} INFO - [2021-06-23 14:03:11,403] {base.py:78} INFO - Using connection to: id: `
   
   ^ In this line it prints out the connection password as well. 
   https://airflow.apache.org/docs/apache-airflow/stable/_modules/airflow/hooks/base.html is printing the logs when `get_connection(cls, conn_id: str)` function is called.
   
   Quoting the source code which causes it to log in the DAG task log without masking `conn.password`
   ```
   log.info(
                   "Using connection to: id: %s. Host: %s, Port: %s, Schema: %s, Login: %s, Password: %s, "
                   "extra: %s",
                   conn.conn_id,
                   conn.host,
                   conn.port,
                   conn.schema,
                   conn.login,
                   conn.password,
                   conn.extra_dejson,
               )
       ```
       
       
       
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org