[AIRFLOW-6774] Creating connections with Airflow CLI leaves sensitive data in clear text in the logs

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.10.9
• Component/s: cli, webserver
• Assignee: Unassigned
• Reporter: Noël BARDELOT
• Created: 11/Feb/20 13:53
• Updated: 11/Feb/20 13:53

Description

See also AIRFLOW-6773

Leaving sensitive data in clear text in logs should be considered a security issue.

Note: the command 'connections --add' is sensitive and should probably not be logged at all in my opinion if there is no simple way of obfuscating the sensitive data.

Steps to reproduce:

1. create a connection using `airflow connections --add` and providing either a password using the switch `conn_password`  or extra data using the switch `conn_extra`
2. go to the Browse / Logs view of the UI
3. find the creation log containing the sensitive data in clear text

The log entry looks like this:

{{

{"host_name": "airflow-web-774c65857f-drgsm", "full_command": "['/usr/local/bin/airflow', 'connections', '--add', '--conn_id', 'test', '--conn_type', 'ssh', '--conn_host', 'example.com', '--conn_login', 'somebody', '--conn_password', 'secret']"}

}}