potiuk opened a new pull request, #65349: URL: https://github.com/apache/airflow/pull/65349
## Summary The Elasticsearch task-log handler groups log hits by `host` and falls back to the raw `[elasticsearch] host` config value when a hit does not carry a `host` field. That config is commonly set to a URL that embeds credentials: ``` [elasticsearch] host = https://user:[email protected]:9200 ``` As a result, the full URL — including the `user:password@` userinfo — appeared as a dictionary key in the task-log output, visible to any user with task-log read permission. This PR adds a small `_strip_userinfo` helper that removes the userinfo portion of a URL, and uses it in `ElasticsearchRemoteLogIO._group_logs_by_host` for the host fallback value. The Elasticsearch client itself is still connected using the full unredacted URL, so authentication is unaffected. ## Test plan - [x] New `test_strip_userinfo` parametrized across 7 input URL shapes (with userinfo, without userinfo, username-only, non-URL, empty) — all pass - [x] Full existing `test_es_task_handler.py` suite continues to pass (71/71) ## Changelog Added a "Bug fixes" section to `providers/elasticsearch/docs/changelog.rst` describing the redaction. ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Opus 4.6 (1M context) Generated-by: Claude Opus 4.6 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
