You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2025/08/04 11:35:25 UTC
[PR] Clarify our security model for sensitive connection information [airflow]
potiuk opened a new pull request, #54088:
URL: https://github.com/apache/airflow/pull/54088
The #53973 introduced a change in the model of handling of the sensitive connection data in the Airlfow UI. Previoiusly our agreed model included capability of reading sensitive data bu the users who have Connection Configuraiton role. However in 3.0.4 we changeed the model so that those users have "write-only" access - they can write the sensitive data, but they cannot read the data via API or the UI once it is written. WHile not a security vulnerability on it's own, it's a security improvement that allows to mitigate some scenarios, especially when connection editing user credentials are stolen.
This PR clarifies the model and properly communicates it to the users clearly indicating the difference implemented in 3.0.4 and the model of our security and clearly explaining that before 3.0.4 that was a delibearate choice of the model that the connection editing users had access to the sensitive data.
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify our security model for sensitive connection information [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #54088:
URL: https://github.com/apache/airflow/pull/54088
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify our security model for sensitive connection information [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #54088:
URL: https://github.com/apache/airflow/pull/54088#discussion_r2251368782
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -115,16 +115,25 @@ Connection configuration users
..............................
They configure connections and potentially execute code on workers during DAG execution. Trust is
-required to prevent misuse of these privileges. They have full access
-to sensitive credentials stored in connections and can modify them.
-Access to sensitive information through connection configuration
+required to prevent misuse of these privileges. They have full write-only access
+to sensitive credentials stored in connections and can modify them, but cannot view them.
+Access to write sensitive information through connection configuration
should be trusted not to be abused. They also have the ability to configure connections wrongly
that might create a API Server Denial of Service situations and specify insecure connection options
which might create situations where executing dags will lead to arbitrary Remote Code Execution
for some providers - either community released or custom ones.
Those users should be highly trusted not to misuse this capability.
+.. note::
+
+ Before Airflow 3.0.4, the **Connection configuration users** role had also access to view the sensitive information this has
+ been changed in Airflow 3.0.4 to improve security of the accidental spilling of credentials of the connection configuration
Review Comment:
Correct. Indeed you are right - there was a bug in 3.0.0 - 3.0.2 that prevented updating those connections via UI and 3.0.3 fixed the bug but also reveled the sensitive data.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify our security model for sensitive connection information [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on code in PR #54088:
URL: https://github.com/apache/airflow/pull/54088#discussion_r2251299113
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -115,16 +115,25 @@ Connection configuration users
..............................
They configure connections and potentially execute code on workers during DAG execution. Trust is
-required to prevent misuse of these privileges. They have full access
-to sensitive credentials stored in connections and can modify them.
-Access to sensitive information through connection configuration
+required to prevent misuse of these privileges. They have full write-only access
+to sensitive credentials stored in connections and can modify them, but cannot view them.
+Access to write sensitive information through connection configuration
should be trusted not to be abused. They also have the ability to configure connections wrongly
that might create a API Server Denial of Service situations and specify insecure connection options
which might create situations where executing dags will lead to arbitrary Remote Code Execution
for some providers - either community released or custom ones.
Those users should be highly trusted not to misuse this capability.
+.. note::
+
+ Before Airflow 3.0.4, the **Connection configuration users** role had also access to view the sensitive information this has
+ been changed in Airflow 3.0.4 to improve security of the accidental spilling of credentials of the connection configuration
Review Comment:
That's not super accurate, it's really just `3.0.3` that introduced a mistake but that was never the intend for AF3 and maybe we shouldn't highlight too much on that. In 3.0.0, 3.0.1, 3.0.2, the API redacts every field, and nothing is revealed. In AF2 though your statement is correct I believe.
I think we can just compare AF3 and AF2.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify our security model for sensitive connection information [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #54088:
URL: https://github.com/apache/airflow/pull/54088#issuecomment-3151483395
### Backport successfully created: v3-0-test
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-0-test</td>
<td><a href="https://github.com/apache/airflow/pull/54100"><img src="https://img.shields.io/badge/PR-54100-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify our security model for sensitive connection information [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on code in PR #54088:
URL: https://github.com/apache/airflow/pull/54088#discussion_r2251385745
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -115,16 +115,25 @@ Connection configuration users
..............................
They configure connections and potentially execute code on workers during DAG execution. Trust is
-required to prevent misuse of these privileges. They have full access
-to sensitive credentials stored in connections and can modify them.
-Access to sensitive information through connection configuration
+required to prevent misuse of these privileges. They have full write-only access
+to sensitive credentials stored in connections and can modify them, but cannot view them.
+Access to write sensitive information through connection configuration
should be trusted not to be abused. They also have the ability to configure connections wrongly
that might create a API Server Denial of Service situations and specify insecure connection options
which might create situations where executing dags will lead to arbitrary Remote Code Execution
for some providers - either community released or custom ones.
Those users should be highly trusted not to misuse this capability.
+.. note::
+
+ Before Airflow 3.0.4, the **Connection configuration users** role had also access to view the sensitive information this has
+ been changed in Airflow 3.0.4 to improve security of the accidental spilling of credentials of the connection configuration
Review Comment:
> I guess we should then update the model to indicate difference between 3 and 2 and yank 3.0.3 eventualy as it does not fulfill the - retroactively updated - model.
I agree with this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify our security model for sensitive connection information [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on code in PR #54088:
URL: https://github.com/apache/airflow/pull/54088#discussion_r2251383070
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -115,16 +115,25 @@ Connection configuration users
..............................
They configure connections and potentially execute code on workers during DAG execution. Trust is
-required to prevent misuse of these privileges. They have full access
-to sensitive credentials stored in connections and can modify them.
-Access to sensitive information through connection configuration
+required to prevent misuse of these privileges. They have full write-only access
+to sensitive credentials stored in connections and can modify them, but cannot view them.
+Access to write sensitive information through connection configuration
should be trusted not to be abused. They also have the ability to configure connections wrongly
that might create a API Server Denial of Service situations and specify insecure connection options
which might create situations where executing dags will lead to arbitrary Remote Code Execution
for some providers - either community released or custom ones.
Those users should be highly trusted not to misuse this capability.
+.. note::
+
+ Before Airflow 3.0.4, the **Connection configuration users** role had also access to view the sensitive information this has
+ been changed in Airflow 3.0.4 to improve security of the accidental spilling of credentials of the connection configuration
Review Comment:
> Correct. Indeed you are right - there was a bug in 3.0.0 - 3.0.2 that prevented updating those connections via UI and 3.0.3 fixed the bug but also reveled the sensitive data.
Exactly
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify our security model for sensitive connection information [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #54088:
URL: https://github.com/apache/airflow/pull/54088#discussion_r2251372155
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -115,16 +115,25 @@ Connection configuration users
..............................
They configure connections and potentially execute code on workers during DAG execution. Trust is
-required to prevent misuse of these privileges. They have full access
-to sensitive credentials stored in connections and can modify them.
-Access to sensitive information through connection configuration
+required to prevent misuse of these privileges. They have full write-only access
+to sensitive credentials stored in connections and can modify them, but cannot view them.
+Access to write sensitive information through connection configuration
should be trusted not to be abused. They also have the ability to configure connections wrongly
that might create a API Server Denial of Service situations and specify insecure connection options
which might create situations where executing dags will lead to arbitrary Remote Code Execution
for some providers - either community released or custom ones.
Those users should be highly trusted not to misuse this capability.
+.. note::
+
+ Before Airflow 3.0.4, the **Connection configuration users** role had also access to view the sensitive information this has
+ been changed in Airflow 3.0.4 to improve security of the accidental spilling of credentials of the connection configuration
Review Comment:
I guess we should then update the model to indicate difference between 3 and 2 and yank 3.0.3 eventualy as it does not fulfill the - retroactively updated - model.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org