You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "leeyspaul (via GitHub)" <gi...@apache.org> on 2026/04/23 03:00:57 UTC
[PR] Mask DFP connection and variable responses [airflow]
leeyspaul opened a new pull request, #65704:
URL: https://github.com/apache/airflow/pull/65704
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
<!--
Thank you for contributing!
Please provide above a brief description of the changes made in this pull request.
Write a good git commit message following this guide: http://chris.beams.io/posts/git-commit/
Please make sure that your code changes are covered with tests.
And in case of new features or big changes remember to adjust the documentation.
Feel free to ping (in general) for the review if you do not see reaction for a few days
(72 Hours is the minimum reaction time you can expect from volunteers) - we sometimes miss notifications.
In case of an existing issue, reference it using one of the following:
* closes: #ISSUE
* related: #ISSUE
-->
Mask DAG File Processor `GetConnection` and `GetVariable` responses so returned secrets are registered with the masker before being sent back to parsing code.
Related: #65624
This is intentionally separate from #65624 so the DFP masking fix can be reviewed and backported independently of the request-handler refactor. We can follow up with a separate PR or add another good first issue to handle the refactor after addressing the immediate fix.
---
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR, please
change below checkbox to `[X]` followed by the name of the tool, uncomment the "Generated-by".
-->
- [x] Yes (please specify the tool below)
<!--
Generated-by: [Tool Name] following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
-->
Generated-by: Codex GPT 5.4
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask DFP connection and variable responses [airflow]
Posted by "leeyspaul (via GitHub)" <gi...@apache.org>.
leeyspaul commented on PR #65704:
URL: https://github.com/apache/airflow/pull/65704#issuecomment-4301670994
@ferruzzi added the mask here in this separate PR, previous context: https://github.com/apache/airflow/pull/65624#issuecomment-4298264683
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask DFP connection and variable responses [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #65704:
URL: https://github.com/apache/airflow/pull/65704
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask DFP connection and variable responses [airflow]
Posted by "leeyspaul (via GitHub)" <gi...@apache.org>.
leeyspaul commented on code in PR #65704:
URL: https://github.com/apache/airflow/pull/65704#discussion_r3128079760
##########
airflow-core/src/airflow/dag_processing/processor.py:
##########
@@ -616,6 +621,8 @@ def _handle_request(self, msg: ToManager, log: FilteringBoundLogger, req_id: int
elif isinstance(msg, GetVariable):
var = self.client.variables.get(msg.key)
if isinstance(var, VariableResponse):
+ if var.value:
Review Comment:
To be refactored with in a future PR: https://github.com/apache/airflow/pull/65269/changes#diff-8e60a504e15c942eae3ffdf0b1a4aa9ffa07919d9815f91b1fa94b63a69acfb5R63
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask DFP connection and variable responses [airflow]
Posted by "leeyspaul (via GitHub)" <gi...@apache.org>.
leeyspaul commented on code in PR #65704:
URL: https://github.com/apache/airflow/pull/65704#discussion_r3128080812
##########
airflow-core/src/airflow/dag_processing/processor.py:
##########
@@ -608,6 +609,10 @@ def _handle_request(self, msg: ToManager, log: FilteringBoundLogger, req_id: int
elif isinstance(msg, GetConnection):
conn = self.client.connections.get(msg.conn_id)
if isinstance(conn, ConnectionResponse):
+ if conn.password:
Review Comment:
To be refactored with: https://github.com/apache/airflow/pull/65269/changes#diff-8e60a504e15c942eae3ffdf0b1a4aa9ffa07919d9815f91b1fa94b63a69acfb5R51
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask DFP connection and variable responses [airflow]
Posted by "leeyspaul (via GitHub)" <gi...@apache.org>.
leeyspaul commented on PR #65704:
URL: https://github.com/apache/airflow/pull/65704#issuecomment-4364415176
The CI failure started after this PR added `mask_secret()` calls to the `GetConnection` and `GetVariable` branches of `_handle_request()`.
That function already had an older function-local import in the later `MaskSecret` branch:
from airflow.sdk.log import mask_secret
In Python, an import inside a function is a local assignment for the entire function scope. Because of that later import, Python treated all `mask_secret` references in `_handle_request()` as local variables, including the new calls that appear before the import. Those earlier calls then failed with `UnboundLocalError`, and Ruff reported the same issue as `F823`.
I fixed it by removing the nested import and use the existing module-level `mask_secret` import consistently. I'm unsure why it passed first, but then later failed on merges. Something I will look into.
Sorry, this PR is now ready to merge. @o-nikolas @vincbeck @ferruzzi
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org