abhishekmauryaKsolves opened a new pull request, #71160:
URL: https://github.com/apache/airflow/pull/71160
closes #71037
## What
`_is_per_key_sensitive_option` and `_mask_per_key_sensitive_options` in
`airflow-core/src/airflow/api_fastapi/core_api/services/public/config.py`
matched literal section names (`secrets`, `workers`) only. A team scoped
spelling of the same option -- the `[<team>=secrets]` config-file section,
or the `AIRFLOW__<TEAM>___SECRETS__BACKEND_KWARG__*` environment variable,
both of which are reported under a section named after the team -- was
never recognised as sensitive.
Not exploitable today, since `_get_custom_secret_backend` is not team-aware
yet. But the gap becomes live the moment secrets backends gain team scoping,
and at that point it fails open: a team's backend credentials would be
returned in full by `GET /config`.
## How
Both functions now resolve the section to its base section via
`base_section_name` -- the same helper
`AirflowConfigParser.is_sensitive_option`
already uses for registered sensitive options (introduced in #70755) --
before deciding whether the option is sensitive.
- `_is_per_key_sensitive_option`: looks up the prefix under
`base_section_name(section)` instead of `section`.
- `_mask_per_key_sensitive_options`: now iterates every section actually
present in `conf_dict` (rather than only the literal `secrets` / `workers`
keys) and resolves each one to its base section before matching. This
also covers the team scoped env var case, since `conf.as_dict` already
reports it under the team-derived section.
## Testing
Added `TestTeamScopedPerKeyBackendKwargMasking` in
`airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_config.py`,
covering:
- `GET /config` redacts a team scoped per-key option under both the
`secrets` and `workers` team scoped sections, while a non-sensitive
option in the same response stays untouched.
- `GET /config/section/{section}/option/{option}` redacts a team scoped
per-key option the same way it redacts the non-team-scoped one.
Full `test_config.py` suite run clean: 3377 passed, 0 failed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
