Skip to content

Commit

Permalink
Don't crash attempting to mask secrets in dict with non-string keys (a…
Browse files Browse the repository at this point in the history
…pache#16601)

(cherry picked from commit 18cb0bb)
  • Loading branch information
ashb authored and kaxil committed Jun 22, 2021
1 parent 8d40ce4 commit 6af516b
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 1 deletion.
2 changes: 1 addition & 1 deletion airflow/utils/log/secrets_masker.py
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ def should_hide_value_for_key(name):
"""Should the value for this given name (Variable name, or key in conn.extra_dejson) be hidden"""
from airflow import settings

if name and settings.HIDE_SENSITIVE_VAR_CONN_FIELDS:
if isinstance(name, str) and settings.HIDE_SENSITIVE_VAR_CONN_FIELDS:
name = name.strip().lower()
return any(s in name for s in get_sensitive_variables_fields())
return False
Expand Down
3 changes: 3 additions & 0 deletions tests/utils/log/test_secrets_masker.py
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,8 @@ def test_mask_secret(self, name, value, expected_mask):
({"secret", "other"}, None, ["secret", "other"], ["***", "***"]),
# We don't mask dict _keys_.
({"secret", "other"}, None, {"data": {"secret": "secret"}}, {"data": {"secret": "***"}}),
# Non string dict keys
({"secret", "other"}, None, {1: {"secret": "secret"}}, {1: {"secret": "***"}}),
(
# Since this is a sensitive name, all the values should be redacted!
{"secret"},
Expand Down Expand Up @@ -213,6 +215,7 @@ class TestShouldHideValueForKey:
("google_api_key", True),
("GOOGLE_API_KEY", True),
("GOOGLE_APIKEY", True),
(1, False),
],
)
def test_hiding_defaults(self, key, expected_result):
Expand Down

0 comments on commit 6af516b

Please sign in to comment.