Eason09053360 opened a new pull request, #73179:
URL: https://github.com/apache/airflow/pull/73179
## Why
`airflow info --anonymize` exists so the report can be pasted into a public
bug report, but it leaves the SQLite database path completely untouched:
```
sql_alchemy_conn | sqlite:////Users/alice/airflow/airflow.db # leaked
base_log_folder | ${HOME}/airflow/logs # masked
airflow_home | ${HOME}/airflow # masked
```
`PiiAnonymizer.process_url` only rewrites the netloc, which is where the
credentials live for PostgreSQL and MySQL. A SQLite URL has no netloc — the
filesystem path *is* the identifying information — so the method falls straight
through to `urlunsplit` and returns its input unchanged, silently. SQLite is
the default backend, so this hits exactly the people most likely to trust the
flag and paste the output somewhere public.
The neighbouring fields in the same table (`plugins_folder`,
`base_log_folder`, `remote_base_log_folder`) already go through `process_path`
and mask correctly.
## What
`airflow-core/src/airflow/cli/commands/info_command.py` — when a URL has no
netloc, `process_url` now hands the whole value to `process_path`, giving
`sqlite:///${HOME}/airflow/airflow.db` and matching how every other path in the
report is treated. The `netloc = None` sentinel is dropped since the new branch
returns early.
This also stops `urlunsplit` mangling netloc-less URLs:
`sqlite:///relative.db` previously came back as `sqlite:/relative.db`.
Both cases are covered by new entries in the existing
`test_should_remove_pii_from_url` parametrize list; URLs with a netloc are
unchanged.
Two related gaps are deliberately left alone. `uname` still reports the
machine hostname — that is being fixed in #73074. And a netloc-less URL can
still carry credentials in its query string
(`mssql+pyodbc:///?odbc_connect=...PWD=secret`), which `process_url` has never
masked; happy to take that in a follow-up if reviewers would rather see it
handled here.
One thing worth a reviewer's opinion: `process_path` does unanchored
substring replacement, so on the official Docker image (`$HOME=/home/airflow`,
user `airflow`, `AIRFLOW_HOME=/opt/airflow`) the connection string now prints
as `sqlite:////opt/${USER}/${USER}.db`. That is the same over-replacement
`base_log_folder` and `airflow_home` already show today, so this PR keeps
`sql_alchemy_conn` consistent with its neighbours rather than special-casing
it. Anchoring the replacement would be a separate change across all five fields.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 5)
Generated-by: Claude Code (Opus 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
