rusackas commented on issue #32664: URL: https://github.com/apache/superset/issues/32664#issuecomment-5258255299
Reopening, this is real and still happening, just a different root cause than what #30532 fixed. Confirmed independently: `Database.password` uses `EncryptedType` with the default `naive` padding scheme, which pads with `*` and unpads via `value.rstrip(b'*')`. Any password with a genuine trailing `*` gets stripped right along with the padding on the next read. Verified it directly against Superset's own field factory: `'mypassword*'` round-trips to `'mypassword'`. @CamiloCarvajalPensemos's diagnosis was exactly right. Opened a TDD PR pinning this: #43074. The actual fix needs some care though, naive padding is sqlalchemy_utils' historical default, and switching padding schemes on an existing deployment has the same re-encryption hazard as the AES-CBC to AES-GCM engine switch already documented in `superset/utils/encrypt.py`. Old encrypted values could become unreadable if we just flip the default without a migration path. Probably worth scoping that as its own follow-up. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
