You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "abhijeets25012-tech (via GitHub)" <gi...@apache.org> on 2026/01/01 07:51:15 UTC
[PR] CLI: secure connection commands by masking sensitive values [airflow]
abhijeets25012-tech opened a new pull request, #60014:
URL: https://github.com/apache/airflow/pull/60014
### What does this PR do?
This PR updates the Airflow CLI connection commands to hide connection values by default and redact sensitive fields such as passwords, tokens, and secrets.
### Why is this needed?
Exposing connection values via the CLI can leak sensitive information. This change aligns with Airflow’s security best practices and prevents accidental disclosure of secrets.
### What was changed?
- Connection values are hidden by default in the CLI
- Sensitive fields are consistently redacted
- Updated implementation to satisfy CodeQL security checks
### How was this tested?
- Verified CLI behavior locally
- Ensured sensitive fields are masked in all default outputs
Related to #59842
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed pull request #60014: CLI: secure connection commands by masking sensitive values
URL: https://github.com/apache/airflow/pull/60014
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "abhijeets25012-tech (via GitHub)" <gi...@apache.org>.
abhijeets25012-tech commented on PR #60014:
URL: https://github.com/apache/airflow/pull/60014#issuecomment-3703712359
Thanks for catching this 👍
I’ve removed the accidental airflow submodule and pushed the fix.
CI should be clean now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #60014:
URL: https://github.com/apache/airflow/pull/60014#discussion_r2659226437
##########
providers/apache/hive/pyproject.toml:
##########
@@ -98,6 +98,12 @@ dependencies = [
"apache-airflow-providers-common-compat"
]
+"sqlalchemy" = [
+ "sqlalchemy>=1.4,<3.0"
+]
+
Review Comment:
This is accidentally added I guess.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "abhijeets25012-tech (via GitHub)" <gi...@apache.org>.
abhijeets25012-tech commented on code in PR #60014:
URL: https://github.com/apache/airflow/pull/60014#discussion_r2657970597
##########
providers/apache/hive/pyproject.toml:
##########
Review Comment:
this added by mistake this is not of this issue ignore it please
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "abhijeets25012-tech (via GitHub)" <gi...@apache.org>.
abhijeets25012-tech commented on PR #60014:
URL: https://github.com/apache/airflow/pull/60014#issuecomment-3707733299
Yah I will fix it today
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "abhijeets25012-tech (via GitHub)" <gi...@apache.org>.
abhijeets25012-tech commented on PR #60014:
URL: https://github.com/apache/airflow/pull/60014#issuecomment-3705790341
“The providers/apache/hive/pyproject.toml was added by mistake in a previous commit and has been removed in the latest force-push (commit 310c1f9). CI is passing and the branch is mergeable. Please ignore the outdated file in the diff view.”
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60014:
URL: https://github.com/apache/airflow/pull/60014#issuecomment-3703705225
This looks good but the airflow submodule should be removed -> it causes CI failure. Not sure why you had airflow submodule and added it ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60014:
URL: https://github.com/apache/airflow/pull/60014#issuecomment-3707471051
Again you have strange submodule added in the PR - please remove it and be more careful what you are submittting. Idealy - review your PR during or right after you create it and see if there are no unrelated changes - this is very distracting and takes a lot of time of maintainers having to review it .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CLI: secure connection commands by masking sensitive values [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60014:
URL: https://github.com/apache/airflow/pull/60014#issuecomment-3716039346
In fact - it's better if you just don't send such PRs if that's going to happen. Closing it for now - you can always create the PR again, properly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org