potiuk opened a new pull request, #72650:
URL: https://github.com/apache/airflow/pull/72650
`_build_metrics` records `sys.argv` into the audit log (`Log.extra`) and
masked
the `variables` value **by position**, assuming the key and value were the
final
two arguments.
Any supported trailing option displaces them. `airflow variables set KEY
VALUE
--description TEXT` ends in `--description TEXT`, so the value was written
to the
audit log in clear. `--description` is the instance, not the class — the
same is
true of `--serialize-json` and of any option added later.
### The change
* **Take the key and value from the parsed `Namespace`** and redact that
value
wherever it appears in the recorded command. Position no longer matters.
* **`--conn-extra` is now masked.** It was not handled at all, and it is
precisely the field connection secrets live in.
* **`--conn-json` and `--conn-extra` are walked recursively.** `--conn-json`
masked only top-level keys, so a secret one level down was recorded in
clear.
* **Both argparse spellings are handled.** `--conn-json`, `--conn-extra` and
`--conn-uri` were matched as standalone tokens only, so the equally valid
`--conn-json=VALUE` form skipped redaction entirely. `--conn-uri` had that
gap
before this change too.
A value that cannot be parsed as JSON is redacted whole: these options carry
connection material, and a value that cannot be inspected is not safe to
record.
### For operators
This prevents *new* disclosures only. **Existing `Log.extra` rows and backups
retain values already written** and should be redacted or expired, and any
credentials exposed that way rotated.
### Tests
Seven new cases: the value displaced by `--description` and by
`--serialize-json`,
a non-sensitive key that must still be recorded as given, nested
`--conn-extra`,
nested `--conn-json`, and the `=` spelling for `--conn-json`, `--conn-extra`
and
`--conn-uri`. All seven fail against unpatched sources; the existing cases
are
unchanged and still pass.
### Not addressed here
`airflow dags trigger --conf` and `airflow backfill create --dag-run-conf`
also
accept JSON that reaches the audit log unmasked. That is a real and separate
pre-existing exposure with a different blast radius, and folding it in would
widen this change beyond the defect it was scoped to. Worth its own issue.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
