roshanprabu opened a new pull request, #71306: URL: https://github.com/apache/airflow/pull/71306
## Summary `airflow.sdk.definitions.connection.Connection` (the Task SDK connection model used inside a running task in Airflow 3.x) masks `extra` fields via `mask_secret()`, but never masked the top-level `password` field, unlike the core ORM `Connection`. This meant secrets such as an Azure service principal secret (which maps to `Connection.password`) leaked into task logs unmasked whenever the connection was resolved through the Task SDK — e.g. when sourced from an `AIRFLOW_CONN_*` environment variable URI. This adds the same `mask_secret(self.password)` / `mask_secret(quote(self.password))` calls that the core `Connection` class already performs, covering both the direct-kwargs constructor and the `from_uri` path. Closes: #38144 ## Test plan - [x] Added `test_password_is_masked` in `task-sdk/tests/task_sdk/definitions/test_connection.py`, covering both the kwargs constructor and `from_uri`. - [x] Verified against a pre-fix checkout that the new assertions fail without the change (masking returns `False`) and pass with it. - [x] `ruff check` and `ruff format --check` pass on the changed files. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
