Rishavbhattarai opened a new pull request, #74618: URL: https://github.com/apache/airflow/pull/74618
Connections supplied as URIs (e.g. `AIRFLOW_CONN_AZURE_DEFAULT`) carry the password percent-encoded. The task SDK only masked the decoded password, so a secret containing special characters leaked in its encoded form (e.g. via `printenv` in a BashOperator). The core `Connection` model already masks `quote(password)`; the task SDK paths did not. - Mask `quote(password, safe="")` in `_mask_connection_secrets`, `_amask_connection_secrets` and `handle_get_connection`. - Use `safe=""` in the core model too, to match `Connection.get_uri` (default `quote` leaves `/` unencoded). - Add a regression test. closes: #38144 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (Claude Code) Generated-by: Claude Code following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
