muditagrawal2007 opened a new pull request, #75129: URL: https://github.com/apache/airflow/pull/75129
RedactedIO masks registered secrets before writes reach stdout, but its `write()` and `writelines()` missed `bytes` / `bytearray`: those values fall through `_redact()` to the default `return item`, then got stringified as `b'…secret…'`, which wrote the cleartext secret to the underlying stream. The only production call site is `airflow tasks test`, which routes task output through `RedactedIO`. Any task that ever wrote bytes to `sys.stdout` — common with subprocess wrappers, log buffers, and some logging libraries — had its secrets printed verbatim, while looking like a redaction. `bytes` and `bytearray` are now decoded as UTF-8 with `errors="replace"` before `redact()` sees them, so the existing pattern-based masker runs. The shared logic is factored into a module-level helper so `write()` and `writelines()` stay symmetric, and the permissive behavior for non-string types added by #72063 is preserved (covered by `test_write_non_string_types_passthrough`). Tests cover `bytes`, `bytearray`, malformed UTF-8, mixed str/bytes in `writelines`, and the non-string passthrough. closes: #75069 ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Minimax-M3 Generated-by: Minimax-M3 following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
