Hi all,

I've opened a small PR that adds opt-in content-pattern detection to
SecretsMasker so that values matching well-known credential formats
get redacted even when they weren't registered ahead of time via
mask_secret():

  https://github.com/apache/airflow/pull/70956

Airflow's SecretsMasker redacts by key name today. Values passed via
XCom, or through Connection extras whose keys don't match a sensitive
keyword, are not redacted -- as noted in the docs
(security/secrets/mask-sensitive-values.rst) and captured in issue
#58514, which was closed as a docs-only clarification without the
underlying gap being addressed. Users still leak credentials this way
by printing environment variables during debugging or logging stack
traces that include a token or PEM block.

The PR adds a curated set of well-known credential formats -- AWS
access keys, GitHub / Slack / Google / Stripe tokens, PEM private-key
blocks, JWTs. Every pattern has a distinctive fixed prefix (very low
false-positive rate) and bounded quantifiers (no ReDoS surface,
reviewed against the same class of issue recently fixed in #70716).
Off by default via a new [core] mask_secrets_content_patterns config
option, so no existing deployment changes behavior.

Six-file diff, +341/-3, tests and docs included. Would especially
value feedback on the initial pattern set and on the widened
log-filter short-circuit.

Thanks,
Deepak Kumar

Reply via email to