bito-code-review[bot] commented on PR #43474:
URL: https://github.com/apache/superset/pull/43474#issuecomment-5398830962
<!-- Bito Reply -->
The security concern is valid. In the current implementation of
`_mask_configuration`, if `get_configuration_schema()` raises an exception, the
function catches it and returns the original, unmasked configuration. This
means that if the schema cannot be loaded, the system fails open, potentially
exposing sensitive credentials.
To resolve this, the function should fail closed by raising an exception or
returning an empty/masked configuration when the schema cannot be retrieved.
Here is a corrected implementation:
```python
try:
schema = cls.get_configuration_schema()
except Exception:
# Fail closed: return an empty configuration or raise an error
return {}
```
I have checked the available PR comments, and there are no other pending
review comments to address. Would you like me to proceed with any other changes?
**superset/semantic_layers/api.py**
```
try:
schema = cls.get_configuration_schema()
except Exception:
# Fail closed: return an empty configuration or raise an error
return {}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
