[hughhhh]

SUMMARY

The event logger stores each request's form, args and JSON body, so the Action Log kept every secret typed into the database dialog, a connection test or an import in clear (database and SSH tunnel passwords, OAuth2 client secrets, embedded fallback credentials, import password / encrypted_extra_secrets maps). collect_request_payload now masks the value of any sensitive key at any depth and keeps sqlalchemy_uri readable with its password and query values masked.

TESTING INSTRUCTIONS

pytest tests/unit_tests/utils/log_tests.py tests/unit_tests/databases/api_test.py -k "redact or never_carries or never_records". The two end-to-end tests fail without the change.

ADDITIONAL INFORMATION

• Has associated issue:
• Changes UI

🤖 Generated with Claude Code

[codeant-ai-for-open-source]

  CodeAnt PR Risk

🟢  Low Risk

• The PR appears safe to merge; URI passwords and query values are now masked before request payloads reach the event log.
• Tests cover URI query credentials, form parameters, and the request logging path.

Assessed commit: 8363b4d4ba41

[codecov]

Codecov Report

❌ Patch coverage is 90.69767% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.93%. Comparing base (730016b) to head (8363b4d).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
superset/utils/log.py	90.69%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #45353   +/-   ##
=======================================
  Coverage   84.93%   84.93%           
=======================================
  Files        3077     3077           
  Lines      208202   208243   +41     
  Branches    49105    49118   +13     
=======================================
+ Hits       176831   176868   +37     
- Misses      28002    28004    +2     
- Partials     3369     3371    +2     

Flag	Coverage Δ
hive	34.19% <27.90%> (-0.01%)	⬇️
mysql	52.18% <76.74%> (+<0.01%)	⬆️
postgres	52.19% <76.74%> (+<0.01%)	⬆️
presto	35.89% <27.90%> (-0.01%)	⬇️
python	87.88% <90.69%> (+<0.01%)	⬆️
sqlite	51.94% <74.41%> (+<0.01%)	⬆️
unit	82.72% <90.69%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aminghadersohi]

Some supported connection credentials still reach the Action Log.

[aminghadersohi]

query_input duplicates the Additional Parameters text beside parameters.query, but only the latter is masked. Entering sslpassword=... still records the credential on validation/save; mask query_input too.

Suggested change

	"privatekey_pass",
	"privatekey_pass",
	"query_input",

[aminghadersohi]

Arc API keys and Dremio ODBC tokens occupy the URI username, so they still reach Action Log records verbatim, with or without query parameters. Mask these credential-bearing usernames before returning the URI.

Suggested change

	if url.password is None and not url.query:
	return uri
	if url.username and (
	url.drivername.split("+", 1)[0] == "arc"
	or url.drivername == "dremio+pyodbc"
	):
	return PASSWORD_MASK
	if url.password is None and not url.query:
	return uri

[aminghadersohi]

Nit: An unencoded '@' followed by '/' or '?' can leave part of a password outside the parsed host, bypassing this check. For example, postgresql://user:p@ss/word@host/db still logs ss/word; mask the whole ambiguous URI.

Suggested change

	if url.host and "@" in url.host:
	return PASSWORD_MASK
	if (url.host and "@" in url.host) or (
	url.password is not None and uri.count("@") > 1
	):
	return PASSWORD_MASK