potiuk opened a new pull request, #70891:
URL: https://github.com/apache/airflow/pull/70891
`_mask_and_deserialize_variable` dispatched on the top-level type of the
deserialized value and handled only `str` and `dict`. A Variable whose JSON
is a
list therefore matched no branch and was returned with nothing inside it
masked.
`add_mask` walks dicts and iterables itself, so the same list nested one
level
inside a dict was already masked -- the top-level dispatch was the only thing
deciding whether the nested values were reached at all.
### Approach
Add the `list` branch, passing the value **under the variable's key** rather
than anonymously.
That distinction is the whole design of the change. Elements of a list have
no
key names of their own, so they follow the variable key's sensitivity -- the
same
rule already applied to a plain string value. Passing the list anonymously
would
mask every element unconditionally and add each to the global pattern set,
so a
Variable holding `["us-east-1", "eu-west-1"]` would cause `us-east-1` to be
redacted everywhere it appeared in any log.
`test_var_json_list_value_does_not_over_mask`
already guarded that, and this keeps it true. Dicts *inside* the list are
still
masked by their own key names.
Verified against the real masker:
| variable | key | result |
|---|---|---|
| `[{"password": "…"}]` | `db_configs` | `[{"password": "***"}]` |
| `["us-east-1", "eu-west-1"]` | `aws_regions` | unchanged |
| `["…"]` | `my_password` | `***` |
| `{"password": "…"}` | `db_config` | `{"password": "***"}` (unchanged path)
|
`test_var_json_list_value_does_not_over_mask` is updated: it asserted
`mask_secret` was called exactly once, and there are now two calls. The
property
it guards is unchanged and the assertion is now stated directly -- the list
is
passed under the variable's key, and never anonymously.
### Test plan
- [x] `test_var_json_masks_list_values` -- list handed to the masker under
the
variable's key
- [x] `test_var_json_list_value_does_not_over_mask` -- updated to assert the
no-over-masking property rather than the call count
- [x] `test_var_json_scalar_values_pass_through` -- int/bool/null/float
returned
unchanged
- [x] Verified against unmodified code: both list tests **fail**
- [x] `test_context.py` -- 170 passed
- [x] `ruff check` / `ruff format` clean
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 5 (1M context)
Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
