fat-catTW commented on PR #72499:
URL: https://github.com/apache/airflow/pull/72499#issuecomment-5556665559
Another related question. Should `POST /dags/{dag_id}/dagRuns` be covered by
this REST API redaction as well?
The PR currently masks the read/list DagRun endpoints, but
`trigger_dag_run()` still returns the newly created `dag_run` directly after
creating it with `conf=params["conf"]`. So if a request triggers a Dag with
`{"conf": {"api_token": "super-secret-value"}}`, and `api_token` is declared as
`Param(..., type="string", format="password")`, the create response may still
echo the raw value, while a later `GET` response would show `"***"`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
