You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "roshanprabu (via GitHub)" <gi...@apache.org> on 2026/08/07 17:28:10 UTC
[PR] Mask Connection password in Task SDK [airflow]
roshanprabu opened a new pull request, #71306:
URL: https://github.com/apache/airflow/pull/71306
## Summary
`airflow.sdk.definitions.connection.Connection` (the Task SDK connection model used inside a running task in Airflow 3.x) masks `extra` fields via `mask_secret()`, but never masked the top-level `password` field, unlike the core ORM `Connection`. This meant secrets such as an Azure service principal secret (which maps to `Connection.password`) leaked into task logs unmasked whenever the connection was resolved through the Task SDK — e.g. when sourced from an `AIRFLOW_CONN_*` environment variable URI.
This adds the same `mask_secret(self.password)` / `mask_secret(quote(self.password))` calls that the core `Connection` class already performs, covering both the direct-kwargs constructor and the `from_uri` path.
Closes: #38144
## Test plan
- [x] Added `test_password_is_masked` in `task-sdk/tests/task_sdk/definitions/test_connection.py`, covering both the kwargs constructor and `from_uri`.
- [x] Verified against a pre-fix checkout that the new assertions fail without the change (masking returns `False`) and pass with it.
- [x] `ruff check` and `ruff format --check` pass on the changed files.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask Connection password in Task SDK [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #71306:
URL: https://github.com/apache/airflow/pull/71306#issuecomment-5769503816
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask Connection password in Task SDK [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #71306:
URL: https://github.com/apache/airflow/pull/71306#issuecomment-5220120609
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our [Contributors' Guide](https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [prek-hooks]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-prek-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example Dag that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
- Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask Connection password in Task SDK [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil commented on PR #71306:
URL: https://github.com/apache/airflow/pull/71306#issuecomment-5942545549
Closing this. Main already masks connection passwords on every Task SDK retrieval path: `_mask_connection_secrets` in `execution_time/context.py` calls `mask_secret(conn.password)` for the preset, cache and secrets-backend paths. Moving masking into `Connection.__init__` masks every constructed `Connection`, and the Task SDK tests fail on this branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Mask Connection password in Task SDK [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil closed pull request #71306: Mask Connection password in Task SDK
URL: https://github.com/apache/airflow/pull/71306
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org