juan-pablo-guereca commented on code in PR #75651:
URL: https://github.com/apache/airflow/pull/75651#discussion_r4539437313
##########
shared/secrets_masker/src/airflow_shared/secrets_masker/secrets_masker.py:
##########
@@ -572,6 +572,14 @@ def _adaptations(self, secret: str) -> Generator[str,
None, None]:
"""Yield the secret along with any adaptations to the secret that
should be masked."""
yield secret
+ # Formatters such as ``pprint`` (used by ``str()`` of Kubernetes
models) split a multi-line
+ # string across several literals, so the secret never appears
contiguously in the output.
+ lines = secret.splitlines()
+ if len(lines) > 1:
Review Comment:
Thanks, adopted as suggested in 8eb6e7acb4: `lines != [secret]`, so
`"token\n"` and `\r\n` values now register their stripped form, and `" error
"` still registers only as itself. I dropped the `if line.strip()` guard, since
`add_mask` already skips empty and too-short values. I added a test for both
`\n` and `\r\n`, and removed the corresponding limit from the description.
---
Drafted-by: Claude Code (Sonnet 5.5); reviewed by @juan-pablo-guereca before
posting
##########
shared/secrets_masker/src/airflow_shared/secrets_masker/secrets_masker.py:
##########
@@ -572,6 +572,14 @@ def _adaptations(self, secret: str) -> Generator[str,
None, None]:
"""Yield the secret along with any adaptations to the secret that
should be masked."""
yield secret
+ # Formatters such as ``pprint`` (used by ``str()`` of Kubernetes
models) split a multi-line
+ # string across several literals, so the secret never appears
contiguously in the output.
+ lines = secret.splitlines()
Review Comment:
Good catch, I hadn't considered that path. I think it's an acceptable
trade-off, so I documented it rather than excluding it: the limits in the
description now cover it, and `mask-sensitive-values.rst` (16b2388cdb) says
that a pretty-printed `extra` has each eligible line masked, that compact
single-line JSON doesn't, and that saving in the UI formats it again. If a
maintainer prefers, I can skip per-line patterns when the multi-line value is
valid JSON instead; that avoids the config-text noise, but a secret that is
itself pretty-printed JSON would lose its per-line masking. I also added your
`redact()` timings to the description.
---
Drafted-by: Claude Code (Sonnet 5.5); reviewed by @juan-pablo-guereca before
posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
