potiuk opened a new pull request, #65912: URL: https://github.com/apache/airflow/pull/65912
`SecretsMasker._redact` short-circuited on `depth > max_depth` before checking whether the current key name was sensitive (`should_hide_value_for_key(name)`). For sensitive keys (`password`, `token`, `secret`, `api_key`, …) nested beyond the recursion depth (default 5), the original value was returned unchanged instead of being replaced with `***`. This PR moves the depth cutoff inside the `try:` block, after the sensitive-key check, and lets dict traversal continue past the cutoff so deeper sensitive keys are still caught. Non-dict containers and the string-pattern masker keep the depth-bounded behavior the cutoff was added for. JSON-loaded payloads cannot be self-referential, and any in-memory cycle hits Python's own recursion limit and falls through the existing exception handler to `"<redaction-failed>"`, preserving the fail-closed property. The contract being repaired is documented on https://airflow.apache.org/docs/apache-airflow/stable/security/secrets/mask-sensitive-values.html — sensitive field names are expected to be masked in API/UI outputs. ### Test plan - [x] Existing `test_redact_max_depth` still passes — non-sensitive over-depth values are returned as-is. - [x] New `test_redact_sensitive_key_past_max_depth` covers the boundary plus two levels past, plus `secret` / `api_key` variants. - [x] Full `shared/secrets_masker` test module: 120 passed, 1 xfail (pre-existing). - [x] `airflow-core/tests/.../test_variables.py`: 74/74 pass. - [x] `prek run --from-ref upstream/main --to-ref HEAD --stage pre-commit` clean. - [x] `mypy shared/secrets_masker/src` clean. ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Opus 4.7 (1M context) Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
