potiuk opened a new pull request, #74840: URL: https://github.com/apache/airflow/pull/74840
`should_hide_value_for_key()` normalised a key by lowercasing it and replacing non-word characters with `_`, then did a substring match against the sensitive field names. That works for snake_case, kebab-case and dotted keys, but camelCase / PascalCase keys lose their word boundaries: `privateKey`, `connectionString`, `webhookUrl`, `accessKey`, `authHeader`, `keyfileDict`, `serviceAccount` and `serviceKey` never matched `private_key`, `connection_string`, `webhook_url` and so on, so their values were not redacted (e.g. in connection extras, rendered fields or CLI output). The key is now additionally split on camelCase / PascalCase boundaries before lowercasing (`privateKey` -> `private_key`, `APIKey` -> `api_key`, `webhookURL` -> `webhook_url`). Matching is done against both the previous normalised form and the split form, so existing behaviour is unchanged — including user-configured names without separators (e.g. `mysensitivekey` still matches `mySensitiveKey`). The change lives in the shared `secrets_masker` library, which is the single implementation used by airflow-core and the Task SDK. Tests: extended `TestShouldHideValueForKey` with camelCase / PascalCase / acronym cases for the default field list, negative cases (`primaryKey`, `connectionTimeout`, `serviceName`), and configured-field cases; updated the comment from #66673 that noted camelCase was not covered. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Opus 5 following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
