You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/04/16 03:16:22 UTC
[PR] Strip userinfo from ES host URL before using it as task-log label [airflow]
potiuk opened a new pull request, #65349:
URL: https://github.com/apache/airflow/pull/65349
## Summary
The Elasticsearch task-log handler groups log hits by `host` and falls back to the raw `[elasticsearch] host` config value when a hit does not carry a `host` field. That config is commonly set to a URL that embeds credentials:
```
[elasticsearch]
host = https://user:password@elk.example.com:9200
```
As a result, the full URL — including the `user:password@` userinfo — appeared as a dictionary key in the task-log output, visible to any user with task-log read permission.
This PR adds a small `_strip_userinfo` helper that removes the userinfo portion of a URL, and uses it in `ElasticsearchRemoteLogIO._group_logs_by_host` for the host fallback value. The Elasticsearch client itself is still connected using the full unredacted URL, so authentication is unaffected.
## Test plan
- [x] New `test_strip_userinfo` parametrized across 7 input URL shapes (with userinfo, without userinfo, username-only, non-URL, empty) — all pass
- [x] Full existing `test_es_task_handler.py` suite continues to pass (71/71)
## Changelog
Added a "Bug fixes" section to `providers/elasticsearch/docs/changelog.rst` describing the redaction.
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 4.6 (1M context)
Generated-by: Claude Opus 4.6 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Strip userinfo from ES host URL before using it as task-log label [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #65349:
URL: https://github.com/apache/airflow/pull/65349#issuecomment-4259122802
Yeah. would love to see your comments @Owen-CH-Leung :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Strip userinfo from ES host URL before using it as task-log label [airflow]
Posted by "Owen-CH-Leung (via GitHub)" <gi...@apache.org>.
Owen-CH-Leung commented on PR #65349:
URL: https://github.com/apache/airflow/pull/65349#issuecomment-4264676160
Great catch! The OpenSearch provider has the same issue also. Worth a follow-up PR to apply the same fix there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Strip userinfo from ES host URL before using it as task-log label [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on PR #65349:
URL: https://github.com/apache/airflow/pull/65349#issuecomment-4257227067
cc @Owen-CH-Leung
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Strip userinfo from ES host URL before using it as task-log label [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #65349:
URL: https://github.com/apache/airflow/pull/65349
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Strip userinfo from ES host URL before using it as task-log label [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #65349:
URL: https://github.com/apache/airflow/pull/65349#discussion_r3090604905
##########
providers/elasticsearch/docs/changelog.rst:
##########
@@ -27,6 +27,17 @@
Changelog
---------
+Bug fixes
+~~~~~~~~~
+
Review Comment:
```suggestion
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Strip userinfo from ES host URL before using it as task-log label [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #65349:
URL: https://github.com/apache/airflow/pull/65349#issuecomment-4262326211
We can always post-review :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org