adiranjan25 opened a new pull request, #76518: URL: https://github.com/apache/airflow/pull/76518
## Summary Fixes an unsafe secret restoration issue in the SecretsMasker where deleting, reordering, or inserting records in a list could cause masked secrets to be restored to the wrong records. Previously, `merge()` relied on positional matching when restoring masked values. When list elements changed, this could result in one record receiving another record's secret. ## Changes - Introduced `UnsafeMaskedSecretMergeError` to explicitly reject unsafe masked-secret restoration. - Added structural validation for lists containing records with masked sensitive values. - Rejects unsafe list deletions, reordering, insertions, and ambiguous record matching rather than restoring secrets by position. - Preserves existing secret restoration behavior for safe list appends and supported scalar-list operations. - Updated Variables and Connections API services to return HTTP 400 when masked secrets cannot be safely restored. - Added regression tests covering deletion, reordering, insertion, duplicate records, nested records, and safe append behavior. ## Testing The following targeted test suites were run: - Secrets Masker: 196 passed, 1 skipped, 1 xfailed. - Variables API: 124 passed. - Connections API: 144 passed, 25 skipped. Ruff checks and formatting checks passed. `git diff --check` also passed. ## Security Considerations The change prevents a masked secret from being silently reassigned to a different record when the original record identity cannot be established safely. In ambiguous cases, the update is rejected instead of risking unintended secret disclosure or reassignment. Closes #76512 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
