hkc-8010 opened a new pull request, #76012:
URL: https://github.com/apache/airflow/pull/76012
Saving a Variable from the UI edit form writes the literal `***` over every
sensitive field in it, because the form is filled from the redacted
`VariableResponse` and the PATCH path stores the body as sent. Connections
avoid this by running `secrets_masker.merge()` on update; this does the same
for Variables.
`update_orm_from_pydantic` in `services/public/variables.py` is shared by
`PATCH /variables/{key}` and the bulk `update` action, so the merge goes there
and covers both. It runs only when `value` is actually being updated (respects
`update_mask`).
- JSON values: both sides are parsed and merged with the variable key as the
name, so a sensitive key name (`db_password`) and sensitive fields at any depth
are both restored, matching how `redact_val` masks them. If nothing was
restored the value is stored exactly as sent, formatting included.
- Non-JSON values: plain string merge, so `***` on a sensitive key keeps the
stored string.
- Fields the user changed, and fields that are new, are saved as sent.
Same limits as the Connections path, unchanged here: a sensitive field
cannot be set to the literal `***`, and a value masked only because it matches
a registered secret (not by key name) is not restored.
Tests: four masked shapes round-tripped through GET then PATCH, a mixed edit
(one secret changed, one field added, other secrets untouched), and the bulk
update path. All six fail on main with the stored value replaced by `***`. Full
`test_variables.py` passes on Python 3.11 and 3.14.
closes: #76011
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
