roykoand opened a new issue, #73255:
URL: https://github.com/apache/airflow/issues/73255
### Under which category would you file this issue?
Providers
### Apache Airflow version
main
### What happened and how to reproduce it?
`airflow config update` with no flags, i.e. dry-run mode, which is the
default, prints the
full contents of `airflow.cfg` to stdout unmasked, including sensitive
values like
`sql_alchemy_conn` (often has an embedded DB password), `fernet_key`,
`secret_key`, and SMTP
credentials.
`airflow config update` is documented/intended as a preview tool for
deprecated/renamed config
options ahead of an Airflow 3 upgrade, not as a config-dumping command, so
this is a surprising
and easy-to-trigger credential leak, especially when run in CI logs or
pasted into a bug report or
support channel.
Repro:
```
$ airflow config update
[blue]Dry-run mode enabled. No changes will be written to airflow.cfg.[/blue]
[core]
...
sql_alchemy_conn =
postgresql+psycopg2://airflow:S3cr3tPassword@db:5432/airflow
...
fernet_key = <real fernet key>
```
### What you think should happen instead?
`airflow config update` should mask sensitive values by default, consistent
with `config list`:
- Give `update_config` the same `--show-values`/`--hide-sensitive` handling
as `show_config`,
masking sensitive options unless the user explicitly opts in to seeing
real values.
- `write_custom_config()` should support hiding sensitive values (or
`update_config` should build
its preview output from the already-masked `config_dict` instead of
re-reading raw
`self._sections`).
### Operating System
_No response_
### Deployment
None
### Apache Airflow Provider(s)
_No response_
### Versions of Apache Airflow Providers
_No response_
### Official Helm Chart version
Not Applicable
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
_No response_
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
