det101 commented on PR #18585: URL: https://github.com/apache/dolphinscheduler/pull/18585#issuecomment-5502921862
@SbloodyS Thank you — you are right that create/update responses were still serializing the merged plaintext `WorkflowDefinition`. We did not only wrap those three service returns. Query-time masking was too easy to miss on write endpoints (and on any new `Result` that carries `Property`), so masking now happens at the HTTP outbound boundary: - `SensitivePropertyResponseAdvice` copy-then-masks `Result.data` when it contains workflow/task/instance `Property` payloads. That includes `createWorkflowDefinition`, `updateWorkflowDefinition`, `updateWorkflowInstance`, version lists, and the existing query/view-variables paths. - Query/write services keep returning plaintext. Persistence and in-process objects are not mutated; only a JSON copy is masked before Jackson writes the body. - Unrelated `Result` payloads (login, cluster, user, …) are left unchanged. Acceptance is unchanged: API/UI still show `******`; the metadata DB is still plaintext in this PR (encryption remains #18587). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
