eduohe opened a new pull request, #11047:
URL: https://github.com/apache/gravitino/pull/11047
### What changes were proposed in this pull request?
Mark \`jdbc-password\` as \`hidden=true\` in
\`JdbcCatalogPropertiesMetadata\` and \`IcebergCatalogPropertiesMetadata\`. The
existing \`BaseCatalog.properties()\` filtering mechanism already strips hidden
properties before the REST response is built — this fix simply applies that
mechanism to the password field, which was incorrectly left as \`hidden=false\`.
Affected catalogs: MySQL, PostgreSQL, Doris, StarRocks (via
\`catalog-jdbc-common\`) and Iceberg (via \`catalog-lakehouse-iceberg\`).
### Why are the changes needed?
\`GET /api/metalakes/{metalake}/catalogs/{catalog}\` was returning
\`jdbc-password\` in plaintext in the response properties map, exposing
credentials to any client with API access.
Fix: #4571
### Doethis PR introduce _any_ user-facing change?
Yes — \`jdbc-password\` is no longer included in catalog API responses.
Clients that were reading it from the response will no longer receive it.
### How was this patch tested?
- Unit tests added to \`TestJdbcCatalogPropertiesMetadata\` and a new
\`TestIcebergCatalogPropertiesMetadata\` asserting the property is hidden and
absent from \`catalog.properties()\`.
- Manually verified via \`GET /api/metalakes/{metalake}/catalogs/{catalog}\`
that \`jdbc-password\` no longer appears in the response for both JDBC and
Iceberg catalogs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
