Samin061 opened a new pull request, #72092: URL: https://github.com/apache/airflow/pull/72092
_create_password builds the --use-random-password value with random.choices, the Mersenne Twister PRNG that Python documents as unfit for security use, so the generated web-login credential comes from a reconstructable stream, and string.printable also seeds it with whitespace and control characters that land in the stored password (roughly 63% of generated values). Switch to secrets.choice over the printable non-whitespace alphabet, matching the generation already used in the teradata provider's encryption_utils and the kubernetes and ssh helpers. Added a regression test asserting the CSPRNG is used and that no whitespace reaches the password. --- ##### Was generative AI tooling used to co-author this PR? - [ ] Yes (please specify the tool below) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
