RehanAhmad25 commented on code in PR #72499:
URL: https://github.com/apache/airflow/pull/72499#discussion_r3975368078
##########
task-sdk/src/airflow/sdk/definitions/param.py:
##########
@@ -382,6 +383,27 @@ def process_params(
if task.params:
params.update(task.params)
if conf.getboolean("core", "dag_run_conf_overrides_params") and
dagrun_conf:
+ # Mask before logging: dag.params/task.params are already merged into
`params` at this
+ # point, so the declared format="password" schema for a key is
available here even though
+ # dagrun_conf hasn't been merged in yet. Registering first ensures the
debug log below is
+ # redacted by the SecretsMasker logging filter rather than emitting
the raw value.
+ _mask_password_values(params, dagrun_conf)
logger.debug("Updating task params (%s) with DagRun.conf (%s)",
params, dagrun_conf)
Review Comment:
Confirmed, thanks. `_mask_password_values(params, dagrun_conf)` only ever
registered values coming from `dagrun_conf`, so a password-format param's
default (never touched by `dagrun_conf`) was never registered before this debug
log line renders `params` itself.
Fixed by also masking `params.dump()` (the current resolved values, defaults
included) right before the log line, in addition to masking `dagrun_conf`.
Added `test_masks_password_default_before_debug_log`: a password param
defaulting to a secret value, with a `dagrun_conf` that only touches an
unrelated key, asserting the default gets registered with `mask_secret()`
before `logger.debug()` fires, not just that some `mask_secret()` call happened
first. Pushed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
