det101 commented on PR #18585:
URL:
https://github.com/apache/dolphinscheduler/pull/18585#issuecomment-5748653770
Thanks for the catch.
The plaintext came from start/command merge: Map-style `startParams` build
`Property` objects without `sensitive=true`, then Master overwrites same-named
workflow globals with that whole object, so instance `globalParams` /
`commandParam` kept the value but lost the flag. Response masking only looks at
`isSensitive()`, so the values leaked.
**Fix (write path, before `commandParam` is persisted)** — in
`restoreStartParams` (used by start / backfill transformers):
1. **Same name as a workflow global** — copy all attributes from the global
(`sensitive`, `direct`, `type`, …) and **only override `value`**. (`******`
still restores the global plaintext for execution.)
2. **Not matching any global** — treat as a normal start param
(`sensitive=false`); it is **not** masked as sensitive.
After that, Master’s existing whole-object merge keeps the inherited
`sensitive` flag on instance globals, so `GET /workflow-instances/{id}` and
`view-variables` mask correctly again via the existing controller mask.
Also masked `commandParam` on monitor `listCommand` / `listErrorCommand` the
same way as other response paths.
Verified with a Map-style start (`{"pwd":"..."}` without `sensitive`) on
local standalone: instance detail and view-variables return `******` with
`sensitive:true`, no plaintext.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
