You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Sanskar121543 (via GitHub)" <gi...@apache.org> on 2026/07/07 11:29:20 UTC
[PR] Add regression tests for _cli_safe_flash escaping in FAB auth manager [airflow]
Sanskar121543 opened a new pull request, #69540:
URL: https://github.com/apache/airflow/pull/69540
## Summary
Adds regression coverage for `_cli_safe_flash` in the FAB auth manager security manager override:
* pre-escaped HTML reaches `flash()` intact as `Markup` — raw user input never renders unescaped (call sites escape with `escape()` before calling)
* outside a request context, HTML tags are converted to terminal-safe text (`<br>` → newline, `<b>`/`</b>` → `*`) and routed to the logger at the requested level
## Why
Prevents accidental unsafe rendering of user-controlled content in FAB auth manager flash messages, and pins the CLI formatting behavior.
## Supersedes #66648
That PR was stale-closed as a draft and the branch has moved since, so it can no longer be reopened. Change since then:
* Removed `test_get_oauth_user_info_azure_with_groups_config`, which asserted `role_keys` is populated from a `groups` claim via an `AUTH_OAUTH_ROLE_KEYS` config key. That key does not exist in the codebase — `get_oauth_user_info()` reads the `roles` claim only — so the test failed deterministically (`AssertionError: assert [] == ['admin-group', 'viewer-group']`). It was also out of scope for this PR.
## Local verification (branch is on top of current `v3-1-test` tip a9eb88d)
* `pytest providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py` → **22 passed** (venv with `apache-airflow==3.1.8` and `flask-appbuilder==4.6.3` per the provider pins)
* Static checks run on the changed file: `ruff`, `ruff-format`, `codespell`, `end-of-file-fixer`, `trailing-whitespace`, `check-merge-conflict`, `debug-statements`, `check-builtin-literals`, `flynt`, `check-lazy-logging` — all pass
* Diff is exactly one test file, +47 lines
Note on the previously flagged `Integration and System Tests / Integration core redis` failure on #66648: this change only adds provider unit tests, so that failure looks unrelated to the diff — happy to investigate if it reappears on a fresh CI run.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes: Claude (Anthropic) — used to diagnose the failing test, remove it, and run the local verification described above; output reviewed by the author.
Generated-by: Claude following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add regression tests for _cli_safe_flash escaping in FAB auth manager [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #69540:
URL: https://github.com/apache/airflow/pull/69540
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add regression tests for _cli_safe_flash escaping in FAB auth manager [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #69540:
URL: https://github.com/apache/airflow/pull/69540#issuecomment-4904948852
Awesome work, congrats on your first merged pull request! You are invited to check our [Issue Tracker](https://github.com/apache/airflow/issues) for additional contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org