QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-09-09 00:34:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(db_engine_specs): always mask OAuth2 client secret in encrypted extra (#43491)

Browse Source
This commit is contained in:
Gabriel Torres Ruiz
2026-08-27 18:42:51 -03:00
committed by GitHub
parent ea3206b076
commit ecbd6578b0
4 changed files with 101 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit_tests/db_engine_specs/test_base.py
+63 -1
View File
@@ -366,6 +366,66 @@ def test_unmask_encrypted_extra() -> None:
)
def test_mask_encrypted_extra_oauth2_client_info_with_narrow_override() -> None:
"""
Test that the OAuth2 client secret is masked even when an engine spec
overrides `encrypted_extra_sensitive_fields` without including it.
"""
class NarrowFieldsSpec(BaseEngineSpec):
encrypted_extra_sensitive_fields = {"$.auth_params.password"}
config = json.dumps(
{
"auth_params": {"password": "my_password"},
"oauth2_client_info": {
"id": "my_client_id",
"secret": "my_client_secret",
},
}
)
assert NarrowFieldsSpec.mask_encrypted_extra(config) == json.dumps(
{
"auth_params": {"password": "XXXXXXXXXX"},
"oauth2_client_info": {
"id": "my_client_id",
"secret": "XXXXXXXXXX",
},
}
)
def test_mask_encrypted_extra_oauth2_client_info_without_sensitive_fields() -> None:
"""
Test that the OAuth2 client secret is masked even when an engine spec
declares no sensitive fields at all.
"""
class NoFieldsSpec(BaseEngineSpec):
encrypted_extra_sensitive_fields: set[str] = set()
config = json.dumps(
{
"auth_params": {"password": "my_password"},
"oauth2_client_info": {
"id": "my_client_id",
"secret": "my_client_secret",
},
}
)
assert NoFieldsSpec.mask_encrypted_extra(config) == json.dumps(
{
"auth_params": {"password": "my_password"},
"oauth2_client_info": {
"id": "my_client_id",
"secret": "XXXXXXXXXX",
},
}
)
@pytest.mark.parametrize(
"masked_encrypted_extra,expected_result",
[
@@ -377,6 +437,7 @@ def test_unmask_encrypted_extra() -> None:
{
"$.credentials_info.private_key",
"$.access_token",
"$.oauth2_client_info.secret",
},
),
(
@@ -387,11 +448,12 @@ def test_unmask_encrypted_extra() -> None:
{
"$.credentials_info.private_key",
"$.access_token",
"$.oauth2_client_info.secret",
},
),
(
None,
{"$.*"},
{"$.*", "$.oauth2_client_info.secret"},
),
],
)