From 79b2c4e1cfb12454b463cb1066ff854d598e97cd Mon Sep 17 00:00:00 2001 From: Robert Saxby Date: Fri, 2 Jul 2021 21:21:56 +0200 Subject: [PATCH] Mask value if the key is ``token`` (#16474) Some connections (including the databricks connection) use the key 'token' in the 'extra' field (this has always been the case). Including it here so that these sensitive tokens are also masked by default. The prior implementation just masked all of the 'extra' json: "XXXXXXXX" if conn.extra_dejson else None https://github.com/apache/airflow/blob/88199eefccb4c805f8d6527bab5bf600b397c35e/airflow/hooks/base.py#L78 GitOrigin-RevId: d1d04fee8ded551c9fd0a13980feab27fbfc0cbe --- airflow/utils/log/secrets_masker.py | 1 + 1 file changed, 1 insertion(+) diff --git a/airflow/utils/log/secrets_masker.py b/airflow/utils/log/secrets_masker.py index 25aa75470b8..537ee0763db 100644 --- a/airflow/utils/log/secrets_masker.py +++ b/airflow/utils/log/secrets_masker.py @@ -42,6 +42,7 @@ 'password', 'private_key', 'secret', + 'token', } ) """Names of fields (Connection extra, Variable key name etc.) that are deemed sensitive"""