(airflow) branch v3-0-test updated: [v3-0-test] Mask secrets when retrieving variables from secrets backend (#50895) (#50998)

[kaxilnaik]

This is an automated email from the ASF dual-hosted git repository.

kaxilnaik pushed a commit to branch v3-0-test
in repository https://gitbox.apache.org/repos/asf/airflow.git


The following commit(s) were added to refs/heads/v3-0-test by this push:
     new 13703e8f29a [v3-0-test] Mask secrets when retrieving variables from 
secrets backend (#50895) (#50998)
13703e8f29a is described below

commit 13703e8f29ad99c5c895fb75fd18c0998b10d746
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Fri May 23 16:50:39 2025 +0530

    [v3-0-test] Mask secrets when retrieving variables from secrets backend 
(#50895) (#50998)
    
    (cherry picked from commit 98f918150e717777088c884f6ee275d1912f9209)
    
    Co-authored-by: Amogh Desai <amoghrajesh1...@gmail.com>
---
 task-sdk/src/airflow/sdk/execution_time/context.py |  3 +++
 .../tests/task_sdk/definitions/test_variables.py   | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/task-sdk/src/airflow/sdk/execution_time/context.py 
b/task-sdk/src/airflow/sdk/execution_time/context.py
index e8b4cb9b6a0..de5c77cb546 100644
--- a/task-sdk/src/airflow/sdk/execution_time/context.py
+++ b/task-sdk/src/airflow/sdk/execution_time/context.py
@@ -39,6 +39,7 @@ from airflow.sdk.definitions.asset import (
     BaseAssetUniqueKey,
 )
 from airflow.sdk.exceptions import AirflowRuntimeError, ErrorType
+from airflow.sdk.execution_time.secrets_masker import mask_secret
 
 if TYPE_CHECKING:
     from uuid import UUID
@@ -180,6 +181,8 @@ def _get_variable(key: str, deserialize_json: bool) -> Any:
                     import json
 
                     var_val = json.loads(var_val)
+                if isinstance(var_val, str):
+                    mask_secret(var_val, key)
                 return var_val
         except Exception:
             log.exception(
diff --git a/task-sdk/tests/task_sdk/definitions/test_variables.py 
b/task-sdk/tests/task_sdk/definitions/test_variables.py
index c9e4698de80..8bcf9ef2819 100644
--- a/task-sdk/tests/task_sdk/definitions/test_variables.py
+++ b/task-sdk/tests/task_sdk/definitions/test_variables.py
@@ -19,6 +19,7 @@ from __future__ import annotations
 
 import json
 from unittest import mock
+from unittest.mock import patch
 
 import pytest
 
@@ -132,6 +133,27 @@ class TestVariableFromSecrets:
             retrieved_var_deser = Variable.get(key="VAR_A", 
deserialize_json=True)
             assert retrieved_var_deser == dict_data
 
+    @patch("airflow.sdk.execution_time.context.mask_secret")
+    def test_var_get_from_secrets_sensitive_key(self, mock_mask_secret, 
mock_supervisor_comms, tmp_path):
+        """Tests getting a variable from secrets backend when deserialize_json 
is provided."""
+        path = tmp_path / "var.json"
+        data = {"secret": "super-secret"}
+        path.write_text(json.dumps(data, indent=4))
+
+        with conf_vars(
+            {
+                (
+                    "workers",
+                    "secrets_backend",
+                ): "airflow.secrets.local_filesystem.LocalFilesystemBackend",
+                ("workers", "secrets_backend_kwargs"): 
f'{{"variables_file_path": "{path}"}}',
+            }
+        ):
+            retrieved_var = Variable.get(key="secret")
+            assert retrieved_var == "super-secret"
+
+            mock_mask_secret.assert_called_with("super-secret", "secret")
+
     
@mock.patch("airflow.secrets.environment_variables.EnvironmentVariablesBackend.get_variable")
     def test_get_variable_env_var(self, mock_env_get, mock_supervisor_comms):
         """Tests getting a variable from environment variable."""