Secrets Masker also applies masking to fields not in scope

[jscheffl]

Body

I tested the connections form and when using the edit (as PR in #48102) I saw that values are masked on the public API.
I created a connection type "generic with name "a" with login="a" and password="a" as well as {"key": "value"} as extra. When opening the connection the public REST was masking the "a" of "value" as below:

I assume it does not make sense to mask data in extra fields or description of connection. This generates errors and side effects unexpected.

Committer

• I acknowledge that I am a maintainer/committer of the Apache Airflow project.

[amarlearning]

I would like to work on this issue. This would be my first contribution to Apache Airflow. I have read the contribution guidelines and have my development environment set up.

[potiuk]

I think it makes sense to only register secret values if they are longer than - say - 5 characters. Any shorter secret makes no sense really.

[potiuk]

But we have to have some warnings in the logs about it (without logging the secret of course).

[jscheffl]

I think it makes sense to only register secret values if they are longer than - say - 5 characters. Any shorter secret makes no sense really.

When examples and default connection are deployed then I usually also fail because "one" of the example connections also uses "airflow" as a password - leading to the fail that logs contain masked folders like /opt/****/conf/... as the term "airflow" then is masked :-D

[potiuk]

I think it makes sense to only register secret values if they are longer than - say - 5 characters. Any shorter secret makes no sense really.

When examples and default connection are deployed then I usually also fail because "one" of the example connections also uses "airflow" as a password - leading to the fail that logs contain masked folders like /opt/****/conf/... as the term "airflow" then is masked :-D

We could explicitly exclude "airflow" from being masked.

[amarlearning]

Here’s the plan

1. Implement a minimum length requirement (5+ characters) for secrets masking
   • Only add patterns to the masking set if the secret length is ≥ 5 characters
   • Add a warning log when a short secret is encountered but not masked
2. Explicitly exclude common terms from masking

cc @potiuk @jscheffl