This is an automated email from the ASF dual-hosted git repository.
mattcasters pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/hop.git
The following commit(s) were added to refs/heads/main by this push:
new a4fe023ff7 SEC-002, SEC-003 linter rule hardening. fixes #8420 (#8421)
a4fe023ff7 is described below
commit a4fe023ff78a6747657eac3c0eff310042aa3d63
Author: Bart Maertens <[email protected]>
AuthorDate: Wed Sep 16 19:29:53 2026 +0200
SEC-002, SEC-003 linter rule hardening. fixes #8420 (#8421)
---
.../java/org/apache/hop/lint/CustomRuleExecutor.java | 13 ++++++++++---
.../org/apache/hop/lint/HardcodedSecretRuleTest.java | 16 ++++++++++++++++
2 files changed, 26 insertions(+), 3 deletions(-)
diff --git
a/plugins/misc/lint/src/main/java/org/apache/hop/lint/CustomRuleExecutor.java
b/plugins/misc/lint/src/main/java/org/apache/hop/lint/CustomRuleExecutor.java
index e16ef121c0..1fe5f6be25 100644
---
a/plugins/misc/lint/src/main/java/org/apache/hop/lint/CustomRuleExecutor.java
+++
b/plugins/misc/lint/src/main/java/org/apache/hop/lint/CustomRuleExecutor.java
@@ -17,6 +17,7 @@
package org.apache.hop.lint;
import java.lang.reflect.Field;
+import java.lang.reflect.Modifier;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
@@ -912,7 +913,7 @@ public class CustomRuleExecutor {
/**
* Whether this field holds the secret the pattern names, rather than merely
mentioning it.
*
- * <p>Two narrowings, both of which cost nothing in coverage and remove
findings that were simply
+ * <p>Three narrowings, all of which cost nothing in coverage and remove
findings that were simply
* wrong. A substring match reported every Token Replacement transform in
the project three times
* over — {@code tokenStartString} defaults to {@code "${"}, {@code
tokenEndString} to {@code "}"}
* — and every Get Data From XML transform once, for the boolean {@code
useToken}. Neither is a
@@ -923,11 +924,17 @@ public class CustomRuleExecutor {
* trustStorePassword} match while {@code tokenStartString}, {@code
oauth2TokenUrl} and
* {@code credentialsFile} do not: a secret is what the field is, not
what it is about;
* <li>the field has to hold a string, because a flag, a count or a list
of columns is never a
- * credential however it is named.
+ * credential however it is named;
+ * <li>the field has to belong to the instance, because a {@code static}
field is part of the
+ * transform's code rather than of the file being linted. The Plugin
Catalog transform's
+ * {@code FIELD_PROPERTY_PASSWORD = "property_password"} is a column
name it writes, and no
+ * edit to a {@code .hpl} or {@code .hwf} can change it or make it
hold a credential.
* </ul>
*/
private static boolean namesASecret(Field field, String pattern) {
- if (Utils.isEmpty(pattern) || !String.class.equals(field.getType())) {
+ if (Utils.isEmpty(pattern)
+ || !String.class.equals(field.getType())
+ || Modifier.isStatic(field.getModifiers())) {
return false;
}
return
field.getName().toLowerCase().endsWith(pattern.trim().toLowerCase());
diff --git
a/plugins/misc/lint/src/test/java/org/apache/hop/lint/HardcodedSecretRuleTest.java
b/plugins/misc/lint/src/test/java/org/apache/hop/lint/HardcodedSecretRuleTest.java
index 04635dd895..54fa7c50f9 100644
---
a/plugins/misc/lint/src/test/java/org/apache/hop/lint/HardcodedSecretRuleTest.java
+++
b/plugins/misc/lint/src/test/java/org/apache/hop/lint/HardcodedSecretRuleTest.java
@@ -47,6 +47,9 @@ public class HardcodedSecretRuleTest {
private boolean useToken = true;
private List<String> tokenReplacementFields = List.of("a", "b");
+ /** A column name the Plugin Catalog transform writes; #8420 reported it
as a leaked secret. */
+ public static final String FIELD_PROPERTY_PASSWORD = "property_password";
+
private String password = "letmein";
private String awsSessionToken = "AQoDYXdzEJr...";
private String proxyPassword = "${PROXY_PASSWORD}";
@@ -68,6 +71,19 @@ public class HardcodedSecretRuleTest {
"${PROXY_PASSWORD} is exactly what the rule asks people to do");
}
+ /**
+ * A constant is part of the transform's code, so no edit to a .hpl or .hwf
can put a credential
+ * in it.
+ *
+ * @see <a href="https://github.com/apache/hop/issues/8420";>#8420</a>
+ */
+ @Test
+ public void aStaticConstantIsNotAHardcodedSecret() {
+ assertTrue(
+ !fieldsReportedFor(new
FakeTransformMeta()).contains("FIELD_PROPERTY_PASSWORD"),
+ "a static constant cannot hold a value loaded from the file being
linted");
+ }
+
/** The field names that put an error on every Token Replacement and Get
Data From XML step. */
@Test
public void aFieldNameThatMerelyMentionsASecretIsNotOne() {
