Copilot commented on code in PR #23935:
URL: https://github.com/apache/datafusion/pull/23935#discussion_r3663587238
##########
datafusion/execution/src/object_store.rs:
##########
@@ -263,14 +263,18 @@ impl ObjectStoreRegistry for DefaultObjectStoreRegistry {
}
}
-/// Get the key of a url for object store registration.
-/// The credential info will be removed
+/// Get the key of a URL for object store registration.
+///
+/// Userinfo is preserved for ABFS schemes, where it identifies a namespace,
+/// and removed for all other schemes.
fn get_url_key(url: &Url) -> String {
- format!(
- "{}://{}",
- url.scheme(),
- &url[url::Position::BeforeHost..url::Position::AfterPort],
- )
+ let key_authority = match url.scheme() {
+ // ABFS encodes the container namespace in URL userinfo.
+ "abfs" | "abfss" =>
&url[url::Position::BeforeUsername..url::Position::AfterPort],
+ _ => &url[url::Position::BeforeHost..url::Position::AfterPort],
+ };
+
+ format!("{}://{key_authority}", url.scheme())
Review Comment:
For `abfs`/`abfss`, slicing `BeforeUsername..AfterPort` preserves the entire
URL userinfo, including any `:password` portion if present (e.g.
`abfss://container:secret@account...`). This can unintentionally keep
credential-like data in the registry key and potentially surface it via debug
output or error messages. Consider preserving only the username (container) and
dropping any password while still disambiguating containers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
