This is an automated email from the ASF dual-hosted git repository.
luwei16 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new ef19f77d3e3 [fix](security) Mask sensitive fields in encryption keys
schema table (#66834)
ef19f77d3e3 is described below
commit ef19f77d3e31ff38073021209bf1dec2d2866079
Author: dzr171712 <[email protected]>
AuthorDate: Wed Aug 19 14:52:15 2026 +0800
[fix](security) Mask sensitive fields in encryption keys schema table
(#66834)
### What problem does this PR solve?
Issue Number: close #CIR-27838
Related PR: #xxx
Problem Summary:
Querying `information_schema.encryption_keys` exposes the original
Base64-encoded initialization vector and ciphertext through the `IV` and
`CIPHER` columns.
The schema scanner previously copied `iv_base64` and `ciphertext_base64`
directly into the result block. This change masks both fields with
`******` when their values are present, while preserving the existing
empty-string behavior when the fields are absent.
A BE unit test is added to verify both the masked-value and empty-value
cases.
### Release note
None
### Check List (For Author)
- Test <!-- At least one of them must be included. -->
- [ ] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason <!-- Add your reason? -->
- Behavior changed:
- [ ] No.
- [x] Yes. The `IV` and `CIPHER` columns in
`information_schema.encryption_keys` now return `******` instead of
exposing their original values.
---
.../schema_encryption_keys_scanner.cpp | 6 ++----
.../schema_encryption_keys_scanner_test.cpp | 17 +++++++++++++++--
2 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/be/src/information_schema/schema_encryption_keys_scanner.cpp
b/be/src/information_schema/schema_encryption_keys_scanner.cpp
index 5e18af0293a..2d67adf2272 100644
--- a/be/src/information_schema/schema_encryption_keys_scanner.cpp
+++ b/be/src/information_schema/schema_encryption_keys_scanner.cpp
@@ -160,12 +160,10 @@ Status
SchemaEncryptionKeysScanner::_fill_block_impl(Block* block) {
}
break;
case 6:
- column_value = encryption_key.has_iv_base64() ?
encryption_key.iv_base64() : "";
+ column_value = encryption_key.has_iv_base64() ? "******" :
"";
break;
case 7:
- column_value = encryption_key.has_ciphertext_base64()
- ? encryption_key.ciphertext_base64()
- : "";
+ column_value = encryption_key.has_ciphertext_base64() ?
"******" : "";
break;
}
diff --git
a/be/test/exec/schema_scanner/schema_encryption_keys_scanner_test.cpp
b/be/test/exec/schema_scanner/schema_encryption_keys_scanner_test.cpp
index 7332ff3c3be..55e16481036 100644
--- a/be/test/exec/schema_scanner/schema_encryption_keys_scanner_test.cpp
+++ b/be/test/exec/schema_scanner/schema_encryption_keys_scanner_test.cpp
@@ -33,13 +33,26 @@ class ScheamEncryptionKeysScannerTest : public
testing::Test {
TEST_F(ScheamEncryptionKeysScannerTest, test_get_next_block_internal) {
SchemaEncryptionKeysScanner scanner;
auto& keys = scanner._master_keys;
- EncryptionKeyPB key;
- keys.push_back(key);
+ keys.emplace_back();
+ EncryptionKeyPB key_with_sensitive_values;
+ key_with_sensitive_values.set_iv_base64("sensitive iv");
+ key_with_sensitive_values.set_ciphertext_base64("sensitive cipher");
+ keys.push_back(key_with_sensitive_values);
auto data_block = Block::create_unique();
scanner._init_block(data_block.get());
auto st = scanner._fill_block_impl(data_block.get());
+ ASSERT_EQ(Status::OK(), st);
+ ASSERT_EQ(2, data_block->rows());
+
+ const auto& iv_column = data_block->safe_get_by_position(6).column;
+ EXPECT_EQ("", (*iv_column)[0].get<TYPE_STRING>());
+ EXPECT_EQ("******", (*iv_column)[1].get<TYPE_STRING>());
+
+ const auto& cipher_column = data_block->safe_get_by_position(7).column;
+ EXPECT_EQ("", (*cipher_column)[0].get<TYPE_STRING>());
+ EXPECT_EQ("******", (*cipher_column)[1].get<TYPE_STRING>());
}
} // namespace doris
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
