hkc-8010 opened a new issue, #76011:
URL: https://github.com/apache/airflow/issues/76011
### Apache Airflow version
3.2.2, also reproduced on main (8401a190fa). The variable PATCH path has no
merge step in any 3.x release (3.0.0 through 3.4.0rc1).
### What happened?
`VariableResponse.redact_val` masks sensitive keys at any depth of a JSON
Variable value, so GET returns `{"connection_env_vars": {"CIFS_PASSWORD":
"***"}}`. The UI edit form is filled from that response. `PATCH
/api/v2/variables/{key}` and the bulk `update` action store the body as sent,
so saving the form without touching the secret writes the literal `***` over
the real value. The same happens for a Variable whose key name is itself
sensitive (e.g. `db_password`).
Connections already handle this: `services/public/connections.py` runs
`secrets_masker.merge()` on `password` and `extra` so an unchanged `***` keeps
the stored value. Variables never got the equivalent.
We hit this on a production deployment where a schedule/timezone Variable
also held a CIFS password. Every UI edit of the schedule broke the password,
and with it every parse of the DAG file that read it, until someone retyped the
masked fields by hand.
### What you think should happen instead?
A `***` that is still in a masked position on save should keep the stored
value, same as for Connections. Fields the user did change, and new fields,
should be saved as sent.
### How to reproduce
```python
import json
from airflow.models import Variable
Variable.set("demo_params", json.dumps({"schedule": "0 7 * * 1-5", "creds":
{"password": "s3cret"}}))
# GET /api/v2/variables/demo_params
# -> {"schedule": "0 7 * * 1-5", "creds": {"password": "***"}}
# Edit only the schedule in the UI (or PATCH the GET value back with
schedule changed), then:
Variable.get("demo_params")
# {"schedule": "0 6 * * 1-5", "creds": {"password": "***"}}
```
### Operating System
Linux (Astro Runtime 3.2-11); reproduced locally on macOS with the 3.2.2
wheel.
### Versions of Apache Airflow Providers
Not relevant.
### Deployment
Astronomer
### Anything else?
#24624 reported the Airflow 2 version of this (FAB edit form prefilled with
`********`) and was closed as stale. I have a fix ready and will open a PR.
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
