[I] `airflow config update` (dry-run, the default) prints unmasked secrets to stdout [airflow]

["roykoand (via GitHub)" <gi...@apache.org>]

roykoand opened a new issue, #73255:
URL: https://github.com/apache/airflow/issues/73255

   ### Under which category would you file this issue?
   
   Providers
   
   ### Apache Airflow version
   
   main
   
   ### What happened and how to reproduce it?
   
   `airflow config update` with no flags, i.e. dry-run mode, which is the default, prints the
   full contents of `airflow.cfg` to stdout unmasked, including sensitive values like
   `sql_alchemy_conn` (often has an embedded DB password), `fernet_key`, `secret_key`, and SMTP
   credentials.
   
   `airflow config update` is documented/intended as a preview tool for deprecated/renamed config
   options ahead of an Airflow 3 upgrade, not as a config-dumping command, so this is a surprising
   and easy-to-trigger credential leak, especially when run in CI logs or pasted into a bug report or
   support channel.
   
   Repro:
   ```
   $ airflow config update
   [blue]Dry-run mode enabled. No changes will be written to airflow.cfg.[/blue]
   [core]
   ...
   sql_alchemy_conn = postgresql+psycopg2://airflow:S3cr3tPassword@db:5432/airflow
   ...
   fernet_key = <real fernet key>
   ```
   
   ### What you think should happen instead?
   
   `airflow config update` should mask sensitive values by default, consistent with `config list`:
   
   - Give `update_config` the same `--show-values`/`--hide-sensitive` handling as `show_config`,
     masking sensitive options unless the user explicitly opts in to seeing real values.
   - `write_custom_config()` should support hiding sensitive values (or `update_config` should build
     its preview output from the already-masked `config_dict` instead of re-reading raw
     `self._sections`).
   
   ### Operating System
   
   _No response_
   
   ### Deployment
   
   None
   
   ### Apache Airflow Provider(s)
   
   _No response_
   
   ### Versions of Apache Airflow Providers
   
   _No response_
   
   ### Official Helm Chart version
   
   Not Applicable
   
   ### Kubernetes Version
   
   _No response_
   
   ### Helm Chart configuration
   
   _No response_
   
   ### Docker Image customizations
   
   _No response_
   
   ### Anything else?
   
   _No response_
   
   ### Are you willing to submit PR?
   
   - [ ] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org