lasdf1234 commented on code in PR #12581:
URL: https://github.com/apache/gravitino/pull/12581#discussion_r3851113353
##########
core/src/main/java/org/apache/gravitino/connector/BaseCatalog.java:
##########
@@ -485,9 +478,10 @@ public Map<String, String> properties() {
if (!shouldBackfillCredential()) {
return properties;
}
+ // Backfill may reintroduce raw credential values; mask them again for the
API response.
Map<String, String> result = Maps.newHashMap(properties);
result.putAll(propertiesWithCredentialProviders());
- return result;
+ return HiddenPropertyMaskUtils.maskHiddenProperties(result,
catalogPropertiesMetadata());
Review Comment:
Agreed — thanks for catching this.
`gravitino.catalog.credential.backfillToProperties=true` is an intentional
escape hatch for legacy connectors that still need plaintext credentials in
catalog properties. Remasking after `propertiesWithCredentialProviders()`
defeated that behavior.
Fixed in the latest commit: the default path still returns `******` for
hidden/credential properties; when backfill is enabled we keep the backfilled
plaintext and no longer remask.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
