Andrushika opened a new issue, #76512:
URL: https://github.com/apache/airflow/issues/76512
### Under which category would you file this issue?
Airflow Core
### Apache Airflow version
main and v3-4-test (adb86572b9)
### What happened and how to reproduce it?
#76012 restores masked values when a user saves a Variable from the UI edit
form. The form shows the redacted value, so each secret arrives as `***`.
`merge()` from the secrets masker then puts the stored secret back.
For a list, `merge()` matches the items by position. If the user deletes or
reorders an item in a list that holds secrets, an item gets the secret of a
different item. No error shows.
The stored value:
```json
{"users": [{"name": "alice", "password": "A-secret"}, {"name": "bob",
"password": "B-secret"}]}
```
The user deletes alice in the edit form and saves. The stored value becomes:
```json
{"users": [{"name": "bob", "password": "A-secret"}]}
```
If the user swaps the two items instead, bob gets `A-secret` and alice gets
`B-secret`.
### How to reproduce
I reproduced it with `merge()`, the function that `PATCH
/api/v2/variables/{key}` calls (`services/public/variables.py`). I did not run
it through the UI.
```python
from airflow_shared.secrets_masker.secrets_masker import (
DEFAULT_SENSITIVE_FIELDS,
_secrets_masker,
merge,
redact,
)
_secrets_masker().sensitive_variables_fields = list(DEFAULT_SENSITIVE_FIELDS)
stored = {"users": [{"name": "alice", "password": "A-secret"}, {"name":
"bob", "password": "B-secret"}]}
shown = redact(stored, "creds")
edited = {"users": [u for u in shown["users"] if u["name"] != "alice"]}
print(merge(edited, stored, "creds"))
# {'users': [{'name': 'bob', 'password': 'A-secret'}]}
### What you think should happen instead?
A `***` should only take back the secret of the same item. If I read
`merge()` right, it has no way to know which item is the same once the list
changes, so I am not sure what the best rule is. Keeping the `***` for items
that moved would at least not give one item the secret of another.
### Operating System
_No response_
### Deployment
None
### Apache Airflow Provider(s)
_No response_
### Versions of Apache Airflow Providers
_No response_
### Official Helm Chart version
Not Applicable
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
_No response_
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
