Repository navigation
Redact bytes and bytearrays written through RedactedIO - #75129
Open
muditagrawal2007 wants to merge 3 commits into
Open
muditagrawal2007 wants to merge 3 commits into
muditagrawal2007 wants to merge 3 commits into
Conversation
RedactedIO masks registered secrets before writes reach stdout. Its write() and writelines() passed inputs through str(redact(...)), but _redact() only walks str and container types -- bytes and bytearray fell through to the default `return item` and were then stringified as b'...secret...', which writes the cleartext secret to the underlying stream. The only production call site, airflow tasks test, wraps task execution in redirect_stdout(RedactedIO()); any task whose code wrote bytes to sys.stdout (subprocess output, log buffers, and some logging libraries) printed its secrets verbatim. Bytes and bytearray values are now decoded as UTF-8 with errors="replace" before redact() sees them, so the existing pattern-based masker runs. The change keeps the permissive behavior for non-string types added by apache#72063 and factors the shared logic into a module-level helper so write() and writelines() stay symmetric. Closes: apache#75069
muditagrawal2007
requested review from
amoghrajesh,
ashb and
potiuk
as code owners
October 19, 2026 17:09
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RedactedIO masks registered secrets before writes reach stdout, but its
write()andwritelines()missedbytes/bytearray: those values fall through_redact()to the defaultreturn item, then got stringified asb'…secret…', which wrote the cleartext secret to the underlying stream.The only production call site is
airflow tasks test, which routes task output throughRedactedIO. Any task that ever wrote bytes tosys.stdout— common with subprocess wrappers, log buffers, and some logging libraries — had its secrets printed verbatim, while looking like a redaction.bytesandbytearrayare now decoded as UTF-8 witherrors="replace"beforeredact()sees them, so the existing pattern-based masker runs. The shared logic is factored into a module-level helper sowrite()andwritelines()stay symmetric, and the permissive behavior for non-string types added by #72063 is preserved (covered bytest_write_non_string_types_passthrough).Tests cover
bytes,bytearray, malformed UTF-8, mixed str/bytes inwritelines, and the non-string passthrough.closes: #75069
Was generative AI tooling used to co-author this PR?
Generated-by: Minimax-M3 following the guidelines