hughhhh opened a new pull request, #45353: URL: https://github.com/apache/superset/pull/45353
### SUMMARY The event logger stores each request's form, args and JSON body, so the Action Log kept every secret typed into the database dialog, a connection test or an import in clear (database and SSH tunnel passwords, OAuth2 client secrets, embedded fallback credentials, import password / `encrypted_extra_secrets` maps). `collect_request_payload` now masks the value of any sensitive key at any depth and keeps `sqlalchemy_uri` readable with only its password masked. ### TESTING INSTRUCTIONS `pytest tests/unit_tests/utils/log_tests.py tests/unit_tests/databases/api_test.py -k "redact or never_carries or never_records"`. The two end-to-end tests fail without the change. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Changes UI 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
