bito-code-review[bot] commented on PR #42492:
URL: https://github.com/apache/superset/pull/42492#issuecomment-5098351773
<!-- Bito Reply -->
The flagged security issue is correct. By defining
`encrypted_extra_sensitive_fields` as a class attribute on
`PrestoBaseEngineSpec`, it is inherited by all descendants, including
`HiveEngineSpec`, `SparkEngineSpec`, and `DatabricksHiveEngineSpec`. This
overrides the default `BaseEngineSpec` behavior, which masks all top-level
fields, and restricts masking only to the three paths defined in the new
attribute, potentially exposing other sensitive fields in Hive-family
connections.
To resolve this, you should move the `encrypted_extra_sensitive_fields`
definition from `PrestoBaseEngineSpec` to `PrestoEngineSpec` and
`TrinoEngineSpec` individually, or ensure that `BaseEngineSpec` retains its
catch-all masking behavior for descendants that do not explicitly override it.
Would you like me to implement this fix and check the rest of the comments
on this PR?
**superset/db_engine_specs/presto.py**
```
class PrestoBaseEngineSpec(BaseEngineSpec, metaclass=ABCMeta):
supports_dynamic_schema = True
supports_catalog = supports_dynamic_catalog =
supports_cross_catalog_queries = True
# Move encrypted_extra_sensitive_fields to concrete classes instead
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
