potiuk commented on code in PR #69908:
URL: https://github.com/apache/airflow/pull/69908#discussion_r3768469552
##########
providers/teradata/src/airflow/providers/teradata/utils/encryption_utils.py:
##########
@@ -54,25 +48,18 @@ def generate_encrypted_file_with_openssl(file_path: str,
password: str, out_file
def decrypt_remote_file_to_string(ssh_client, remote_enc_file, password,
bteq_command_str):
- # Run openssl decrypt command on remote machine
- quoted_password = shell_quote_single(password)
-
+ # Use -pass stdin to avoid shell quoting on any OS and keep the passphrase
+ # out of the remote process table where ps could expose it.
decrypt_cmd = (
- f"openssl enc -d -aes-256-cbc -salt -pbkdf2 -pass
pass:{quoted_password} -in {shlex.quote(remote_enc_file)} | "
- + bteq_command_str
+ f"openssl enc -d -aes-256-cbc -salt -pbkdf2 -pass stdin -in
{remote_enc_file} | " + bteq_command_str
Review Comment:
The path lost its quoting here — main had `-in
{shlex.quote(remote_enc_file)}`, and the `shlex` import was removed along with
it. A remote path containing a space now breaks the command. (This came from my
snippet in the previous review, which dropped it — my mistake.)
```suggestion
decrypt_cmd = (
f"openssl enc -d -aes-256-cbc -salt -pbkdf2 -pass stdin -in
{shlex.quote(remote_enc_file)} | "
+ bteq_command_str
)
```
…with `import shlex` restored at the top.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
