Aditya-kumar-yadav opened a new pull request, #75215:
URL: https://github.com/apache/airflow/pull/75215
When displaying connection details with sensitive values masked (`airflow
connections get` and `connections list --show-values --hide-sensitive`),
`_mask_uri_credentials` previously split `netloc` on the first `@`.
This led to two bugs:
1. **Password leakage**: If a URI password contains an `@` character (e.g.
`postgresql://user:p@ssword@host:5432/db`), splitting on the first `@` caused
`_creds` to receive only `user:p` and `host_port` to receive
`ssword@host:5432`. Consequently, the remainder of the cleartext password
(`ssword`) was printed in the host portion of the masked URI. Splitting from
the right with `rsplit("@", 1)` ensures all userinfo before the host is
properly isolated.
2. **Artificial password injection**: When a URI contained only a username
or token without a password (e.g. `ssh://git@host:22/repo`), the function
unconditionally formatted
`f"{SENSITIVE_PLACEHOLDER}:{SENSITIVE_PLACEHOLDER}@{host_port}"`, injecting an
artificial `:***` password field where none was present. It now preserves
whether username-only, password-only, or user-and-password credentials are
provided.
Added unit test cases to `TestUriMasking` in `test_connection_command.py`
covering passwords containing `@`, username-only credentials, password-only
credentials, empty passwords, and userinfo with colons.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Antigravity
Generated-by: Antigravity following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
