ephraimbuddy commented on code in PR #76306:
URL: https://github.com/apache/airflow/pull/76306#discussion_r4455168407
##########
shared/secrets_masker/src/airflow_shared/secrets_masker/secrets_masker.py:
##########
@@ -562,13 +556,14 @@ def merge(
Takes a user-modified redacted item and merges it with the original
unredacted item.
For sensitive fields that still contain "***" (or whatever the
``replacement`` is specified as), the
original value is restored. For fields that have been updated, the new
value is preserved.
+
+ ``max_depth`` is ignored: containers are walked at any depth, as
``redact`` does, and the
+ parameter is kept for backward compatibility.
Review Comment:
"as `redact` does" reads as if `redact` ignores `max_depth` too, but it
still bounds `_redact_all` for a sensitive subtree. Merge copes because that
cut-off subtree arrives as `"***"` with `force_sensitive` set and is restored
whole. Maybe:
```suggestion
``max_depth`` is ignored and kept for backward compatibility.
Containers are walked at any
depth; a sensitive subtree that ``redact`` collapsed at its
``max_depth`` is restored whole.
```
##########
airflow-core/src/airflow/api_fastapi/core_api/services/public/variables.py:
##########
@@ -85,14 +67,23 @@ def update_orm_from_pydantic(
raise RequestValidationError(errors=e.errors())
non_update_fields = {"key"}
+ # The UI edit form is filled from the redacted response, so saving it
unchanged would otherwise
+ # write ``***`` over every sensitive field.
if (
"value" in patch_body.model_fields_set
and (not update_mask or "value" in update_mask)
and isinstance(patch_body.value, str)
+ and old_variable.val is not None
):
- patch_body = patch_body.model_copy(
- update={"value": _restore_redacted_value(patch_body.value,
old_variable.val, old_variable.key)}
- )
+ try:
+ new_obj, old_obj = json.loads(patch_body.value),
json.loads(old_variable.val)
+ except json.JSONDecodeError:
+ merged_value = merge(patch_body.value, old_variable.val,
old_variable.key)
Review Comment:
`old_variable.val` is a synonym over `get_val`, so each read runs a Fernet
decrypt, and on a bad token each read logs `Can't decrypt _val ...` again. This
now reads it up to three times; the helper read it once. Binding it first keeps
the "no behaviour change" exact:
```suggestion
and (old_value := old_variable.val) is not None
):
try:
new_obj, old_obj = json.loads(patch_body.value),
json.loads(old_value)
except json.JSONDecodeError:
merged_value = merge(patch_body.value, old_value,
old_variable.key)
```
(Or a plain `old_value = old_variable.val` above the `if`, if you'd rather
avoid the walrus.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
