Repository navigation
Mask registered secrets at any nesting depth - #73793
Merged
Merged
Conversation
Pattern-based masking of registered secrets stopped at max_depth: a string nested deeper than that was returned without the replacer being applied, while key-name masking already worked at any depth. Apply the replacer to string leaves wherever they sit. max_depth still bounds the fail-closed walk of a value already known to be sensitive. Generated-by: Claude Opus 5
Generated-by: Claude Opus 5
Member
Author
|
@amoghrajesh Could you take a look at this when you have a moment? It's targeted at 3.4.0 and needs a review to make the cut on 2026-10-19. CI is green. |
vatsrahul1001
approved these changes
Oct 18, 2026
vatsrahul1001
left a comment
vatsrahul1001
left a comment
Contributor
There was a problem hiding this comment.
Looks good to me. Only string leaves were bounded by max_depth; the dict and iterable branches were already unbounded, so removing the check does not change the recursion behavior, and _redact_all keeps its fail-closed bound.
Contributor
Backport successfully created: v3-4-testNote: As of Merging PRs targeted for Airflow 3.X In matter of doubt please ask in #release-management Slack channel.
|
potiuk
added a commit
that referenced
this pull request
Oct 19, 2026
…5112) * Mask registered secrets at any nesting depth Pattern-based masking of registered secrets stopped at max_depth: a string nested deeper than that was returned without the replacer being applied, while key-name masking already worked at any depth. Apply the replacer to string leaves wherever they sit. max_depth still bounds the fail-closed walk of a value already known to be sensitive. Generated-by: Claude Opus 5 * Add newsfragment (cherry picked from commit bfa2390) Generated-by: Claude Opus 5 Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
vatsrahul1001
pushed a commit
that referenced
this pull request
Oct 20, 2026
…5112) * Mask registered secrets at any nesting depth Pattern-based masking of registered secrets stopped at max_depth: a string nested deeper than that was returned without the replacer being applied, while key-name masking already worked at any depth. Apply the replacer to string leaves wherever they sit. max_depth still bounds the fail-closed walk of a value already known to be sensitive. Generated-by: Claude Opus 5 * Add newsfragment (cherry picked from commit bfa2390) Generated-by: Claude Opus 5 Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pattern-based masking of registered secrets stopped at
max_depth: a string nested deeper than that was returned without the replacer being applied, while key-name masking already worked at any depth. The replacer now applies to string leaves wherever they sit;max_depthstill bounds the fail-closed walk of a value already known to be sensitive. Updates themax_depthtest cases that asserted the old behaviour and adds a case for a secret embedded in a longer string.🤖 Generated with Claude Code