You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "jscheffl (via GitHub)" <gi...@apache.org> on 2025/03/22 22:00:37 UTC
[I] Secrets Masker also applies masking to fields not in scope [airflow]
jscheffl opened a new issue, #48105:
URL: https://github.com/apache/airflow/issues/48105
### Body
I tested the connections form and when using the edit (as PR in #48102) I saw that values are masked on the public API.
I created a connection type "generic with name "a" with login="a" and password="a" as well as `{"key": "value"}` as extra. When opening the connection the public REST was masking the "a" of "value" as below:
I assume it does not make sense to mask data in extra fields or description of connection. This generates errors and side effects unexpected.
### Committer
- [x] I acknowledge that I am a maintainer/committer of the Apache Airflow project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secrets Masker also applies masking to fields not in scope [airflow]
Posted by "amarlearning (via GitHub)" <gi...@apache.org>.
amarlearning commented on issue #48105:
URL: https://github.com/apache/airflow/issues/48105#issuecomment-2746177451
I would like to work on this issue. This would be my first contribution to Apache Airflow. I have read the contribution guidelines and have my development environment set up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secrets Masker also applies masking to fields not in scope [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #48105:
URL: https://github.com/apache/airflow/issues/48105#issuecomment-2764956730
But we have to have some warnings in the logs about it (without logging the secret of course).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secrets Masker also applies masking to fields not in scope [airflow]
Posted by "amarlearning (via GitHub)" <gi...@apache.org>.
amarlearning commented on issue #48105:
URL: https://github.com/apache/airflow/issues/48105#issuecomment-2767276966
Here’s the plan
1. Implement a minimum length requirement (5+ characters) for secrets masking
- Only add patterns to the masking set if the secret length is ≥ 5 characters
- Add a warning log when a short secret is encountered but not masked
2. Explicitly exclude common terms from masking
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secrets Masker also applies masking to fields not in scope [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #48105:
URL: https://github.com/apache/airflow/issues/48105#issuecomment-2764956386
I think it makes sense to only register secret values if they are longer than - say - 5 characters. Any shorter secret makes no sense really.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secrets Masker also applies masking to fields not in scope [airflow]
Posted by "ashb (via GitHub)" <gi...@apache.org>.
ashb closed issue #48105: Secrets Masker also applies masking to fields not in scope
URL: https://github.com/apache/airflow/issues/48105
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secrets Masker also applies masking to fields not in scope [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl commented on issue #48105:
URL: https://github.com/apache/airflow/issues/48105#issuecomment-2766859985
> I think it makes sense to only register secret values if they are longer than - say - 5 characters. Any shorter secret makes no sense really.
When examples and default connection are deployed then I usually also fail because "one" of the example connections also uses "airflow" as a password - leading to the fail that logs contain masked folders like `/opt/****/conf/...` as the term "airflow" then is masked :-D
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secrets Masker also applies masking to fields not in scope [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #48105:
URL: https://github.com/apache/airflow/issues/48105#issuecomment-2767221718
> > I think it makes sense to only register secret values if they are longer than - say - 5 characters. Any shorter secret makes no sense really.
>
> When examples and default connection are deployed then I usually also fail because "one" of the example connections also uses "airflow" as a password - leading to the fail that logs contain masked folders like `/opt/****/conf/...` as the term "airflow" then is masked :-D
We could explicitly exclude "airflow" from being masked.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org