rusackas commented on PR #41974: URL: https://github.com/apache/superset/pull/41974#issuecomment-4997264274
Thanks for this, @hainenber. Bito's thread on the test mock is still open and looks right: `utils.py` does `from superset import db`, so patching `superset.db` in the test doesn't touch what `load_configs` actually calls, and `db.session.query.return_value` is set to a plain `dict` where the code expects `.all()`. As written the db-sourced secret path (the reason for the `SECRET_TO_BE_SEEN` setup) never actually gets exercised. Also CodeQL is still failing on this file with a new high-severity clear-text-logging alert, and nobody answered your question in that thread about whether the redaction covers it. Want to close that loop, since this is a sec fix landing on top of an open security alert? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
