shahar1 commented on code in PR #68975:
URL: https://github.com/apache/airflow/pull/68975#discussion_r3625448896
##########
task-sdk/src/airflow/sdk/execution_time/context.py:
##########
@@ -317,6 +317,16 @@ async def _async_get_connection(conn_id: str) ->
Connection:
raise AirflowNotFoundException(f"The conn_id `{conn_id}` isn't defined")
+def _mask_and_deserialize_variable(raw: str, key: str, deserialize_json: bool)
-> Any:
+ mask_secret(raw, key)
+ if not deserialize_json:
+ return raw
+ val = json.loads(raw)
+ if not isinstance(val, str):
+ mask_secret(val)
Review Comment:
This guard might regress masking for string scalars. For
`var.json.my_password` storing `'"s3cr3t"'`, only the quoted raw is registered
as a pattern - it never matches the unquoted `s3cr3t` that lands in
`rendered_task_instance_fields`, so the secret renders in plain text (this case
works on main today). The other branch has the opposite problem:
`mask_secret(val)` without name is the unconditional-masking mode, so a
non-sensitive list variable like var.json.regions gets all its elements
globally redacted from task logs.
Drafted by: Code Claude, reviewed by myself.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
