amoghrajesh commented on code in PR #54449:
URL: https://github.com/apache/airflow/pull/54449#discussion_r2292894148
##########
airflow-core/src/airflow/dag_processing/processor.py:
##########
@@ -409,6 +409,10 @@ def _handle_request(self, msg: ToManager, log:
FilteringBoundLogger, req_id: int
elif isinstance(msg, GetVariable):
var = self.client.variables.get(msg.key)
if isinstance(var, VariableResponse):
+ if var.value:
+ from airflow.sdk.log import mask_secret
+
+ mask_secret(var.value, var.key)
Review Comment:
Good catch, thanks. I realised one thing, we only handled masking in
_get_variable for custom backends:
https://github.com/apache/airflow/blob/main/task-sdk/src/airflow/sdk/execution_time/context.py#L185-L186
and we never happened to really notice it because as a follow up, we masked in
supervisor too
https://github.com/apache/airflow/blob/main/task-sdk/src/airflow/sdk/execution_time/supervisor.py#L1187-L1196
Just to be safe, adding masking in _get_variable for defence in depth.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@airflow.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
