fat-catTW commented on PR #72499:
URL: https://github.com/apache/airflow/pull/72499#issuecomment-5549524848
Thanks for contribution!
One thing I noticed in the task-log masking path: when `[core]
dag_run_conf_overrides_params` is enabled, `process_params()` logs the raw
`dagrun_conf` before password-format values are registered with `mask_secret()`.
```python
if conf.getboolean("core", "dag_run_conf_overrides_params") and dagrun_conf:
logger.debug("Updating task params (%s) with DagRun.conf (%s)", params,
dagrun_conf)
params.update(dagrun_conf)
resolved_params = params.validate()
_mask_password_params(params, resolved_params)
return resolved_params
```
This means a password-format value from `DagRun.conf` can be sent to the
logging path before it has been registered with the secrets masker. For
example, a run triggered with `{"api_token": "super-secret-value"}` for a
`Param(..., type="string", format="password")` could still emit a debug log
containing the raw `"super-secret-value"`.
Could we either register password-format values before this log line, or
avoid logging raw `dagrun_conf` here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
