') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix: exclude JWT token from workload repr to prevent log exposure by SibtainOcn · Pull Request #62964 · apache/airflow · GitHub
Skip to content

fix: exclude JWT token from workload repr to prevent log exposure - #62964

Merged
kaxil merged 14 commits into
apache:mainfrom
SibtainOcn:fix/redact-token-from-workload-repr
Mar 7, 2026
Merged

fix: exclude JWT token from workload repr to prevent log exposure#62964
kaxil merged 14 commits into
apache:mainfrom
SibtainOcn:fix/redact-token-from-workload-repr

Conversation

@SibtainOcn

@SibtainOcnSibtainOcn commented Mar 5, 2026•
edited by eladkal
Loading

Copy link
Copy Markdown
Contributor

What

Prevents JWT tokens from leaking into task logs by setting repr=False on the token field in BaseWorkloadSchema.

Closes: #62428
Closes: #62773

Why

When workload objects are logged (e.g. log.info('Executing workload', workload=workload) in execute_workload.py), Pydantic's auto-generated __repr__ includes all fields — including the raw JWT token. This is a security concern since tokens grant API access and should never appear in log output.

The log output currently looks like:

ExecuteTask(token='eyJhbGciOi...full_token_here', ti=TaskInstance(...), ...)

How

Uses Pydantic's built-in Field(repr=False) on the token field in BaseWorkloadSchema (the base class for all workload DTOs). This:

  1. Excludes the token from repr()/str() output — so it never appears in logs
  2. Preserves full access via workload.token — no functional change
  3. Fixes all executors at the model level — KubernetesExecutor, CeleryExecutor, ECS, etc.

After the fix, log output shows:

ExecuteTask(ti=TaskInstance(...), dag_rel_path=..., type='ExecuteTask')

Comparison with #62782

PR #62782 takes a different approach: it modifies the logging call sites to log individual fields and adds a structlog regex redactor. Our approach fixes the root cause at the model level (1 line change vs 4 files), ensuring the token is hidden from repr regardless of where or how the workload object is logged.

Both approaches are valid and complementary — Field(repr=False) prevents the leak at the source, while a structlog redactor provides defense-in-depth.

Changes

  • airflow-core/src/airflow/executors/workloads/base.py: Add Field import; set repr=False on token field
  • airflow-core/tests/unit/executors/test_workloads.py: Add regression test verifying token is excluded from repr
  • airflow-core/newsfragments/62428.bugfix.rst: Changelog entry

Testing

  • Added unit test test_token_excluded_from_workload_repr that creates an ExecuteTask with a fake JWT and asserts repr() does not contain it
  • Verified locally with Pydantic 2.12.5

@SibtainOcn
fix: exclude JWT token from workload repr to prevent log exposure
faa0c0e
Prevents JWT tokens from leaking into task logs by setting
repr=False on the token field in BaseWorkloadSchema.
When workload objects are logged (e.g. in execute_workload.py),
Pydantic's auto-generated __repr__ previously included the raw
JWT token string. This is a security concern as tokens should
never appear in log output.
The fix uses Pydantic's Field(repr=False) to exclude the token
from string representations while keeping it fully accessible
as an attribute.
Fixes: #62428
@boring-cyborg

boring-cyborgBot commented Mar 5, 2026

Copy link
Copy Markdown

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

  • Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
  • In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
  • Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
  • Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
  • Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
  • Be sure to read the Airflow Coding style.
  • Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
    Apache Airflow is a community-driven project and together we are making it better 🚀.
    In case of doubts contact the developers at:
    Mailing List: dev@airflow.apache.org
    Slack: https://s.apache.org/airflow-slack

@boring-cyborgboring-cyborgBot added the area:Executors-core LocalExecutor & SequentialExecutor label Mar 5, 2026
kaxil
kaxil reviewed Mar 5, 2026
View reviewed changes
Comment threadairflow-core/src/airflow/executors/workloads/base.py
kaxil
kaxil reviewed Mar 5, 2026
View reviewed changes
Comment threadairflow-core/tests/unit/executors/test_workloads.py Outdated
@kaxil
kaxil requested a review from CopilotMarch 5, 2026 22:00
@kaxilkaxil added this to the Airflow 3.2.0 milestone Mar 5, 2026
CopilotAI reviewed Mar 5, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a security issue where JWT tokens were being exposed in task logs via Pydantic's auto-generated __repr__ output. When workload objects are logged (e.g., log.info("Executing workload", workload=workload)), the full JWT token was visible in structured log output. The fix uses Pydantic's Field(repr=False) on the token field in BaseWorkloadSchema, the base class for all workload DTOs.

Changes:

  • Set repr=False on the token field in BaseWorkloadSchema to prevent JWT tokens from appearing in repr/str output
  • Added a regression test to verify the token is excluded from repr() while remaining accessible as an attribute
  • Added a changelog newsfragment for the bugfix

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

FileDescription
airflow-core/src/airflow/executors/workloads/base.pyAdded Field import and set repr=False on the token field in BaseWorkloadSchema
airflow-core/tests/unit/executors/test_workloads.pyAdded regression test test_token_excluded_from_workload_repr verifying token exclusion from repr
airflow-core/newsfragments/62428.bugfix.rstChangelog entry for the bugfix

You can also share your feedback on Copilot code review. Take the survey.

Comment threadairflow-core/tests/unit/executors/test_workloads.py Outdated
Comment threadairflow-core/tests/unit/executors/test_workloads.py Outdated
eladkal
eladkal previously requested changes Mar 5, 2026
View reviewed changes
Comment threadtest_fix_verification.py Outdated
@SibtainOcn
SibtainOcn requested a review from eladkalMarch 5, 2026 23:02
XD-DENG
XD-DENG requested changes Mar 6, 2026
View reviewed changes
Comment threadairflow-core/newsfragments/62964.bugfix.rst
@XD-DENGXD-DENG mentioned this pull request Mar 6, 2026
Merged
1 task
@eladkaleladkal added the type:bug-fix Changelog: Bug Fixes label Mar 6, 2026
@eladkaleladkal mentioned this pull request Mar 6, 2026
Closed
1 task
@SibtainOcn

SibtainOcn commented Mar 6, 2026

Copy link
Copy Markdown
ContributorAuthor

Hey, all the review comments have been addressed and pushed. Just waiting on CI workflow approval whenever someone gets a chance.

@SibtainOcn

SibtainOcn commented Mar 6, 2026

Copy link
Copy Markdown
ContributorAuthor

I done fix for the trailing blank line that keeps failing the static checks. Verified locally with pre-commit and trailing-whitespace, end-of-file checks pass now. Hope this goes through, if it still fails, could use some help understanding what the hook expects ?

@kaxil
kaxil merged commit b196cf3 into apache:mainMar 7, 2026
74 checks passed
@boring-cyborg

boring-cyborgBot commented Mar 7, 2026

Copy link
Copy Markdown

Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions.

@github-actions

github-actionsBot commented Mar 7, 2026

Copy link
Copy Markdown
Contributor

Backport failed to create: v3-1-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

StatusBranchResult
❌v3-1-testCommit Link

You can attempt to backport this manually by running:

cherry_picker b196cf3 v3-1-test

This should apply the commit to the v3-1-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.

@SibtainOcn
SibtainOcn deleted the fix/redact-token-from-workload-repr branch March 7, 2026 09:35
@pierrejeambrun

pierrejeambrun commented Mar 9, 2026

Copy link
Copy Markdown
Member

@kaxil needs manual backport

@kaxil

kaxil commented Mar 9, 2026

Copy link
Copy Markdown
Member

@kaxil needs manual backport

@vatsrahul1001 Can you do it?

vatsrahul1001 pushed a commit that referenced this pull request Mar 11, 2026
@SibtainOcn@vatsrahul1001
fix: Exclude JWT token from workload repr to prevent log exposure (#6…
d336be1
…2964)
Closes: #62428Closes: #62773
(cherry picked from commit b196cf3)
@vatsrahul1001

vatsrahul1001 commented Mar 11, 2026

Copy link
Copy Markdown
Contributor

@kaxil needs manual backport

@vatsrahul1001 Can you do it?

backport PR #63328

vatsrahul1001 added a commit that referenced this pull request Mar 11, 2026
@vatsrahul1001@SibtainOcn
fix: Exclude JWT token from workload repr to prevent log exposure (#6…
56c28a5
…2964) (#63328)
(cherry picked from commit b196cf3)
Co-authored-by: Pineapple <224004177+SibtainOcn@users.noreply.github.com>
dominikhei pushed a commit to dominikhei/airflow that referenced this pull request Mar 11, 2026
@SibtainOcn@dominikhei
fix: Exclude JWT token from workload repr to prevent log exposure (ap…
6168ee4
…ache#62964)
Closes: apache#62428Closes: apache#62773
vatsrahul1001 added a commit that referenced this pull request Mar 25, 2026
@vatsrahul1001@SibtainOcn
fix: Exclude JWT token from workload repr to prevent log exposure (#6…
bd3d855
…2964) (#63328)
(cherry picked from commit b196cf3)
Co-authored-by: Pineapple <224004177+SibtainOcn@users.noreply.github.com>
@pierrejeambrunpierrejeambrun mentioned this pull request Apr 7, 2026
Closed
2 tasks
@nixpkgs-security-trackernixpkgs-security-trackerBot mentioned this pull request Apr 17, 2026
Closed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@tirkarthitirkarthitirkarthi approved these changes
@kaxilkaxilkaxil approved these changes
@XD-DENGXD-DENGXD-DENG approved these changes
@ashbashbAwaiting requested review from ashbashb is a code owner
@o-nikolaso-nikolasAwaiting requested review from o-nikolaso-nikolas is a code owner
@pierrejeambrunpierrejeambrunAwaiting requested review from pierrejeambrunpierrejeambrun is a code owner
@hussein-awalahussein-awalaAwaiting requested review from hussein-awalahussein-awala is a code owner
@dheerajturagadheerajturagaAwaiting requested review from dheerajturagadheerajturaga is a code owner
@eladkaleladkalAwaiting requested review from eladkal

Assignees

No one assigned

Labels

area:Executors-coreLocalExecutor & SequentialExecutortype:bug-fixChangelog: Bug Fixes

Projects

None yet

Milestone

Airflow 3.2.0

Development

Successfully merging this pull request may close these issues.

JWT tokens appearing in logs JWT tokens appearing in task logs

8 participants

@SibtainOcn@pierrejeambrun@kaxil@vatsrahul1001@tirkarthi@XD-DENG@eladkal