potiuk opened a new pull request, #68422: URL: https://github.com/apache/airflow/pull/68422
The secrets masker walks dicts unconditionally for key-name-based redaction, so a sensitive key nested in dicts is masked at any depth. Lists, tuples, and sets, however, were only walked below the recursion-depth cutoff — so a value carrying a sensitive key wrapped in an iterable beyond the cutoff was returned without key-name redaction. This walks nested lists/tuples/sets unconditionally too, mirroring the dict handling, keeping the depth cutoff only for pattern-based string masking. Adds regression tests for sensitive keys wrapped in lists and tuples past `MAX_RECURSION_DEPTH`. ### Tests - [X] Extended `test_redact_sensitive_key_past_max_depth` with list- and tuple-wrapped cases past the cutoff - [X] Existing `test_redact_max_depth` (pattern-masking depth bound) unchanged - [X] Full `test_secrets_masker.py` suite green ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Opus 4.8 (1M context) Generated-by: Claude Opus 4.8 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
