Pissinatti-py opened a new pull request, #71719:
URL: https://github.com/apache/airflow/pull/71719
Extra fields whose key name is sensitive — SSH's `private_key` /
`private_key_passphrase`, the
reporter's case in #53410 — are free-form keys that no provider declares in
`hook_meta`. They get
no schema, so `FieldSelector` falls back to `paramPlaceholder` and renders
them as plain
`FieldString` inputs.
Stored values already come back redacted from the API (#59873), so this is
not about the value on
screen at rest — it is about the value being typed. Anything entered into
one of those fields was
legible to anyone looking at the screen, which is exactly the scenario this
masking is meant to
cover. #70473 fixed this for extra fields a provider declares with `format:
"password"`; free-form
keys were explicitly left out there because the UI had no signal to go on.
This adds that signal. The effective sensitive-name list
(`DEFAULT_SENSITIVE_FIELDS` unioned with
`[core] sensitive_var_conn_names`) is exposed on the existing `/ui/config`
endpoint, and
`FieldSelector`'s password branch now also matches on field name, reusing
`FieldPassword` /
`PasswordToggle` from #70473. The name match is a port of
`SecretsMasker.should_hide_value_for_key`,
so `spark.hadoop.fs.s3a.access.key` matches `access_key` the same way it
does server-side.
The extra JSON blob is deliberately left alone — it stays redacted as #59873
made it.
Notes for review:
- Only field *names* cross the wire, never values, and the list is empty when
`[core] hide_sensitive_var_conn_fields = False`. `/ui/config` requires
authentication; these two
options are already readable via `/config` when `[api] expose_config` is
on.
- `FieldSelector` is shared with the Dag trigger form, so a Dag param named
`password` or `token`
now renders masked too. That seemed right rather than surprising — same
threat, same treatment —
but say the word if you would rather it were scoped to connections only.
- The password branch keeps its position in the dispatch chain, so
enum/boolean/number/array fields
keep their widgets; a checkbox named `use_secret_manager` is not turned
into a password box. The
`"null"` field type is included so an empty free-form field is masked
before anything is typed
into it.
related: #53410
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 5)
Generated-by: Claude Code (Opus 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
