Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs by sunank200 · Pull Request #59688 · apache/airflow

sunank200 · 2025-12-21T10:26:20Z

Problem

The KiotaRequestAdapterHook was logging sensitive information at INFO level:

Client secrets
Proxy URLs with embedded credentials (e.g., http://user:pass@proxy.example.com:3128) were logged in plain text

Fix

Add "proxies" to DEFAULT_SENSITIVE_FIELDS in the shared secrets_masker
Use redact(proxies, name="proxies") to automatically mask proxy configurations containing credentials
Use redact(client_secret, name="client_secret") to mask client secrets

Testing

Added unit tests to verify
Manually tested with a custom DAG using KiotaRequestAdapterHook and following is the screenshot of the task logs:

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

amoghrajesh

We are almost there, one comment

amoghrajesh

One comment, otherwise LGTM

text at INFO level.

parameter to automatically mask proxy configurations containing credentials.

Re-export redact from airflow.sdk.log and add to compat module import map to enable unconditional import via airflow.providers.common.compat.sdk

….secrets_masker to the import fallback chain for redact to support compact 3.0.6 and 3.1.5 environments

DEFAULT_SENSITIVE_FIELDS in secrets_masker to ensure proxy configurations are treated as sensitive by default regardless of field naming convention.

amoghrajesh

LGTM thanks

github-actions · 2025-12-24T10:13:02Z

Backport failed to create: v3-1-test. View the failure log Run details

Status	Branch	Result
❌	v3-1-test

You can attempt to backport this manually by running:

cherry_picker a9dea6d v3-1-test

This should apply the commit to the v3-1-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

…ogged in Microsoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688) (cherry picked from commit a9dea6d)

…rosoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688)

…ogged in Microsoft Graph hook logs (#59688) (#59792) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (#59688) (cherry picked from commit a9dea6d)

…rosoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688)

…ogged in Microsoft Graph hook logs (#59688) (#59792) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (#59688) (cherry picked from commit a9dea6d)

…rosoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688)

heepengpeng · 2026-01-27T08:35:23Z

Is this related to https://nvd.nist.gov/vuln/detail/CVE-2025-68675

kravii · 2026-02-02T18:32:57Z

Can we please get a confirmation on above if it is a targeted fix for - CVE-2025-68675 ?

potiuk · 2026-02-03T10:09:02Z

Yeah. It is. We have not linked the PR to the CVE (we usually do) - we will also fix it in the CVE announcement itself. Thanks for asking @heepengpeng @kravii

potiuk · 2026-02-03T14:40:39Z

Yeah. It is. We have not linked the PR to the CVE (we usually do) - we will also fix it in the CVE announcement itself. Thanks for asking @heepengpeng @kravii

The CVE should be updated shortly to contain link to that PR

kravii · 2026-02-03T14:50:47Z

thanks a lot for the confirmation @potiuk.

…rosoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688)

boring-cyborgBot added area:providers provider:microsoft-azure Azure-related issues labels Dec 21, 2025

sunank200 force-pushed the fix-msgraph-secret-logging branch from a8fafc1 to 8e45f9dCompare December 21, 2025 20:39

sunank200 marked this pull request as ready for review December 21, 2025 21:06

sunank200 requested review from amoghrajesh, ashb and potiuk as code owners December 21, 2025 21:06

sunank200 force-pushed the fix-msgraph-secret-logging branch from 4c4d6a6 to e6276eaCompare December 21, 2025 23:15

uranusjr reviewed Dec 22, 2025
View reviewed changes

Comment threadproviders/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py Outdated

sunank200 force-pushed the fix-msgraph-secret-logging branch from e6276ea to 7755235Compare December 22, 2025 06:22

amoghrajesh reviewed Dec 22, 2025
View reviewed changes

Comment threadproviders/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py Outdated
Comment threadproviders/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py Outdated

sunank200 requested a review from kaxil as a code owner December 22, 2025 06:59

sunank200 removed the request for review from kaxil December 22, 2025 06:59

sunank200 force-pushed the fix-msgraph-secret-logging branch from 23d0833 to 6f78a11Compare December 22, 2025 07:13

sunank200 requested a review from amoghrajesh December 22, 2025 14:25

amoghrajesh reviewed Dec 23, 2025
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/log.py Outdated
Comment threadtask-sdk/src/airflow/sdk/log.py Outdated

sunank200 force-pushed the fix-msgraph-secret-logging branch from 9f3db7c to c33e3e4Compare December 23, 2025 07:55

sunank200 requested a review from amoghrajesh December 23, 2025 07:55

amoghrajesh reviewed Dec 23, 2025
View reviewed changes

Comment threadproviders/common/compat/src/airflow/providers/common/compat/sdk.py
Comment threadproviders/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py Outdated
Comment threadtask-sdk/src/airflow/sdk/log.py

sunank200 force-pushed the fix-msgraph-secret-logging branch from 3b307d7 to 05525d1Compare December 23, 2025 09:21

sunank200 requested a review from amoghrajesh December 23, 2025 09:22

amoghrajesh approved these changes Dec 23, 2025
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/log.py
Comment threadproviders/common/compat/src/airflow/providers/common/compat/sdk.py Outdated

potiuk reviewed Dec 23, 2025
View reviewed changes

Comment threadairflow-core/newsfragments/59688.improvement.rst Outdated

potiuk added the backport-to-v3-1-test label Dec 23, 2025

potiuk added this to the Airflow 3.1.6 milestone Dec 23, 2025

sunank200 force-pushed the fix-msgraph-secret-logging branch from b3cb3da to 39479cdCompare December 23, 2025 14:32

sunank200 requested a review from potiuk December 23, 2025 14:32

sunank200 added 3 commits December 23, 2025 20:54

Prevent client secrets and proxy credentials from being logged in plain
1b5e8a8
text at INFO level.

Add 'proxies' to DEFAULT_SENSITIVE_FIELDS and use redact() with name
c01e86f
parameter to automatically mask proxy configurations containing credentials.

Add newsfragment for proxies addition to DEFAULT_SENSITIVE_FIELDS
1b67b41

sunank200 added 6 commits December 23, 2025 20:54

Use compat module for redact import in Microsoft Graph hook
edcd513
Re-export redact from airflow.sdk.log and add to compat module import map to enable unconditional import via airflow.providers.common.compat.sdk

Add airflow.sdk._shared.secrets_masker and airflow.sdk.execution_time…
f24cc38
….secrets_masker to the import fallback chain for redact to support compact 3.0.6 and 3.1.5 environments

Simplify redact re-export in log.py
227cfc4

Remove explicit __all__ declaration as it's not needed for the re-export
665e22d

Fix PR comments: import paths changes
4f3e1bd

Add both singular and plural forms of proxy field names to
2c6b2c1
DEFAULT_SENSITIVE_FIELDS in secrets_masker to ensure proxy configurations are treated as sensitive by default regardless of field naming convention.

sunank200 force-pushed the fix-msgraph-secret-logging branch from 39479cd to 2c6b2c1Compare December 23, 2025 15:09

amoghrajesh approved these changes Dec 24, 2025
View reviewed changes

vatsrahul1001 approved these changes Dec 24, 2025
View reviewed changes

vatsrahul1001 merged commit a9dea6d into apache:mainDec 24, 2025
97 checks passed

vatsrahul1001 deleted the fix-msgraph-secret-logging branch December 24, 2025 10:11

sunank200 mentioned this pull request Dec 24, 2025
[v3-1-test] Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (#59688) #59792
Merged

shahar1 mentioned this pull request Dec 30, 2025
Status of testing Providers that were prepared on December 30, 2025 #59952
Closed
54 tasks

Uh oh!

Conversation

sunank200 commented Dec 21, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Testing

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amoghrajesh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amoghrajesh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amoghrajesh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actionsBot commented Dec 24, 2025

Backport failed to create: v3-1-test. View the failure log Run details

Uh oh!

heepengpeng commented Jan 27, 2026

Uh oh!

kravii commented Feb 2, 2026

Uh oh!

potiuk commented Feb 3, 2026

Uh oh!

potiuk commented Feb 3, 2026

Uh oh!

kravii commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

sunank200 commented Dec 21, 2025•
edited
Loading