You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "andreahlert (via GitHub)" <gi...@apache.org> on 2026/02/23 07:10:30 UTC
[PR] feat: hide sensitive values by default in CLI connections/variables list [airflow]
andreahlert opened a new pull request, #62344:
URL: https://github.com/apache/airflow/pull/62344
## Summary
Implements the security enhancement requested in issue #59844 to prevent accidental exposure of sensitive connection credentials and variable values in CLI output.
## Changes
- **CLI Arguments**: Added `--show-values` and `--hide-sensitive` flags to both `airflow connections list` and `airflow variables list` commands
- **Default Behavior**: Commands now show only connection IDs/types and variable keys by default, hiding sensitive values
- **Security**: Sensitive data requires explicit `--show-values` flag to be displayed
- **Performance**: Optimized database queries to avoid unnecessary decryption when values will be masked
- **URI Masking**: Implemented smart credential masking that preserves URI structure while hiding passwords
- **Testing**: Added comprehensive test coverage for edge cases and security scenarios
- **Code Quality**: Refactored mapper logic into dedicated classes for better maintainability
## Backward Compatibility
All existing functionality is preserved. The changes are purely additive with new default behavior being more secure.
## Testing
- Added unit tests for URI masking logic
- Added integration tests for CLI flag combinations
- Added edge case tests for None/empty values
- All existing tests continue to pass
Closes #59844
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: hide sensitive values by default in CLI connections/variables list [airflow]
Posted by "andreahlert (via GitHub)" <gi...@apache.org>.
andreahlert commented on PR #62344:
URL: https://github.com/apache/airflow/pull/62344#issuecomment-3943098196
This PR is part of the implementation for issue #59838 (Consistent approach for sensitive value masking in CLIs), specifically addressing the local CLI list commands requirement that they should only return keys by default and require `--show-values` to display sensitive data.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: hide sensitive values by default in CLI connections/variables list [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #62344:
URL: https://github.com/apache/airflow/pull/62344#issuecomment-4038891353
@andreahlert This PR has been converted to **draft** because it does not yet meet our [Pull Request quality criteria](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-quality-criteria).
**Issues found:**
- :x: **Pre-commit / static checks**: Failing: CI image checks / Static checks. Run `prek run --from-ref main` locally to find and fix issues. See [Pre-commit / static checks docs](https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst).
> **Note:** Your branch is **110 commits behind `main`**. Some check failures may be caused by changes in the base branch rather than by your PR. Please rebase your branch and push again to get up-to-date CI results.
**What to do next:**
- The comment informs you what you need to do.
- Fix each issue, then mark the PR as "Ready for review" in the GitHub UI - but only after making sure that all the issues are fixed.
- Maintainers will then proceed with a normal review.
Converting a PR to draft is **not** a rejection — it is an invitation to bring the PR up to the project's standards so that maintainer review time is spent productively. If you have questions, feel free to ask on the [Airflow Slack](https://s.apache.org/airflow-slack).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: hide sensitive values by default in CLI connections/variables list [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #62344:
URL: https://github.com/apache/airflow/pull/62344
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org