Skip to content

[SECURITY] Prevent credential leakage in GitHook by removing auth from repo URL#64103

Draft
abhijeets25012-tech wants to merge 1 commit intoapache:mainfrom
abhijeets25012-tech:fix/git-credential-leak
Draft

[SECURITY] Prevent credential leakage in GitHook by removing auth from repo URL#64103
abhijeets25012-tech wants to merge 1 commit intoapache:mainfrom
abhijeets25012-tech:fix/git-credential-leak

Conversation

@abhijeets25012-tech
Copy link
Copy Markdown
Contributor

Problem

Currently, GitHook embeds credentials (username/token) directly in the repository URL for HTTP(S) connections.
This can cause sensitive information to be exposed in DAG parsing, logs, or .git/config.

Solution

  • Removed embedding credentials in the URL.
  • Added secure token-based authentication using GIT_ASKPASS.
  • Disabled interactive prompts with GIT_TERMINAL_PROMPT=0.
  • Preserved SSH support for git@ URLs and local paths.
  • Fully backward-compatible; does not affect existing SSH workflows.

Security Impact

  • Prevents cleartext credentials from being persisted in Git configuration.
  • Ensures DAG authors cannot accidentally exfiltrate tokens during parsing.

Testing

  • Verified repo URLs with/without tokens.
  • Confirmed SSH keys and GIT_ASKPASS work as expected.

@potiuk potiuk marked this pull request as draft March 23, 2026 17:19
@potiuk
Copy link
Copy Markdown
Member

potiuk commented Mar 23, 2026

@abhijeets25012-tech This PR has been converted to draft because it does not yet meet our Pull Request quality criteria.

Issues found:

  • Merge conflicts: This PR has merge conflicts with the main branch. Your branch is 258 commits behind main. Please rebase your branch (git fetch origin && git rebase origin/main), resolve the conflicts, and push again. See contributing quick start.

Note: Your branch is 258 commits behind main. Some check failures may be caused by changes in the base branch rather than by your PR. Please rebase your branch and push again to get up-to-date CI results.

What to do next:

  • The comment informs you what you need to do.
  • Fix each issue, then mark the PR as "Ready for review" in the GitHub UI - but only after making sure that all the issues are fixed.
  • There is no rush — take your time and work at your own pace. We appreciate your contribution and are happy to wait for updates.
  • Maintainers will then proceed with a normal review.

Converting a PR to draft is not a rejection — it is an invitation to bring the PR up to the project's standards so that maintainer review time is spent productively. There is no rush — take your time and work at your own pace. We appreciate your contribution and are happy to wait for updates. If you have questions, feel free to ask on the Airflow Slack.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants