ruanwenjun commented on PR #18585:
URL:
https://github.com/apache/dolphinscheduler/pull/18585#issuecomment-5693336119
> `mask(WorkflowInstance)` masks `globalParams`, `varPool`, and `dagData`,
but leaves `commandParam` unchanged. The trigger transformer restores `******`
to plaintext, `WorkflowManualTrigger` serializes those values into
`commandParams`, and `RunWorkflowCommandHandler` persists that JSON on the
workflow instance. As a result, `GET /workflow-instances/{id}` can still expose
sensitive start-parameter values through `commandParam`. Please mask
`ICommandParam.commandParams` in the response copy and add regression coverage
for this endpoint.
+1, need to mask the commandParams at controller， but the command params
doesn't have type, need to find the type from localparam/global param.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
