zanarellidev opened a new pull request, #8027: URL: https://github.com/apache/hop/pull/8027
Follow-up from a private report I sent to [email protected] (forwarded to the Hop PMC). ASF Security's read was that this isn't a vulnerability under Hop's threat model (SECURITY.md §7/§13 — the caller already needs Hop Server credentials, which is out of scope), but they agreed the asymmetry is worth fixing on its own merits and suggested I open it as a normal contribution instead. That's this PR. ## What `Execution.parameterValues` had no `@JsonIgnore`, while the sibling `variableValues` field is already `@Deprecated @JsonIgnore`'d for the same reason: `Execution` is serialized wholesale to JSON by `GetExecutionInfoServlet` (`GET /hop/getExecInfo`) and the REST `LocationResource`, and pipeline/workflow parameters routinely carry secrets (DB passwords, API tokens). ## Fix Add `@JsonIgnore` to `parameterValues`, matching the existing `variableValues` protection. This only affects JSON (de)serialization — in-process consumers (`BaseExecutionViewer`, `WorkflowExecutionViewer`, `PipelineExecutionViewer`) read the values directly via the Java getter and are unaffected. ## Test plan - [x] Added `ExecutionTest.testParameterValuesNotSerialized`: asserts neither `parameterValues` nor `variableValues` (nor their values) appear in the JSON produced by `HopJson`, while other fields still serialize normally. - [x] Confirmed fail-before/pass-after locally: reverting the `@JsonIgnore` reproduces the leak (test fails with the plaintext value present in the JSON), reapplying it passes. - [x] `mvn -pl engine -am test -Dtest=org.apache.hop.execution.*` and `mvn -pl rest -am test` both green. - [x] `spotless:apply` run. - [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) This report was prepared with AI coding-agent assistance, independently verified against current source and tests before opening. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
