shahar1 commented on code in PR #71711: URL: https://github.com/apache/airflow/pull/71711#discussion_r4054096488
########## providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_submit.py: ########## @@ -55,6 +55,30 @@ _K8S_WAIT_APP_COMPLETION_CONF = "spark.kubernetes.submission.waitAppCompletion" +# Values to mask are anchored at a token boundary: without the lookbehind the leading +# \S*? retries at every offset in the string, which is what made masking pathologically +# slow on long arguments and log lines. Anchoring does not make this strictly O(n) -- a +# token packing many "secret"/"password" occurrences still backtracks quadratically -- +# but it removes the retry-per-offset factor and is orders of magnitude faster in +# practice. A quote only closes the value when whitespace or the end of the string +# follows it, so quoted values may themselves contain quotes, but never a newline: +# an unterminated quote would otherwise swallow the log lines that follow it. +_SENSITIVE_VALUE_RE = re.compile( Review Comment: There's a regression: IN : 'Config(secret="x",password=hunter2)' OLD: 'Config(secret="",password=' NEW: 'Config(secret="******",password=hunter2)' ← leaks The masking regex only starts looking for secrets at whitespace boundaries. In a log snippet like: ``` Config(secret="x",password=hunter2) ``` it masks secret, but after finishing the quoted "x" it is still inside the same non-whitespace token (Config(...)). Because it cannot restart scanning there, it never notices the later password= field - so hunter2 is exposed. --- Drafted by Codex, verified by me -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
