Sanskar121543 opened a new pull request, #69540: URL: https://github.com/apache/airflow/pull/69540
## Summary Adds regression coverage for `_cli_safe_flash` in the FAB auth manager security manager override: * pre-escaped HTML reaches `flash()` intact as `Markup` — raw user input never renders unescaped (call sites escape with `escape()` before calling) * outside a request context, HTML tags are converted to terminal-safe text (`<br>` → newline, `<b>`/`</b>` → `*`) and routed to the logger at the requested level ## Why Prevents accidental unsafe rendering of user-controlled content in FAB auth manager flash messages, and pins the CLI formatting behavior. ## Supersedes #66648 That PR was stale-closed as a draft and the branch has moved since, so it can no longer be reopened. Change since then: * Removed `test_get_oauth_user_info_azure_with_groups_config`, which asserted `role_keys` is populated from a `groups` claim via an `AUTH_OAUTH_ROLE_KEYS` config key. That key does not exist in the codebase — `get_oauth_user_info()` reads the `roles` claim only — so the test failed deterministically (`AssertionError: assert [] == ['admin-group', 'viewer-group']`). It was also out of scope for this PR. ## Local verification (branch is on top of current `v3-1-test` tip a9eb88d) * `pytest providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py` → **22 passed** (venv with `apache-airflow==3.1.8` and `flask-appbuilder==4.6.3` per the provider pins) * Static checks run on the changed file: `ruff`, `ruff-format`, `codespell`, `end-of-file-fixer`, `trailing-whitespace`, `check-merge-conflict`, `debug-statements`, `check-builtin-literals`, `flynt`, `check-lazy-logging` — all pass * Diff is exactly one test file, +47 lines Note on the previously flagged `Integration and System Tests / Integration core redis` failure on #66648: this change only adds provider unit tests, so that failure looks unrelated to the diff — happy to investigate if it reappears on a fresh CI run. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes: Claude (Anthropic) — used to diagnose the failing test, remove it, and run the local verification described above; output reviewed by the author. Generated-by: Claude following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
