rusackas commented on code in PR #43474:
URL: https://github.com/apache/superset/pull/43474#discussion_r3847323919
##########
superset/semantic_layers/api.py:
##########
@@ -81,10 +81,44 @@
logger = logging.getLogger(__name__)
+def _mask_configuration(layer: SemanticLayer, config: dict[str, Any]) ->
dict[str, Any]:
+ """
+ Redact configuration values the connector's schema marks as write-only.
+
+ A connector publishes its configuration shape via
``get_configuration_schema``;
+ a property with ``"writeOnly": true`` (the standard JSON Schema way of
+ marking a field that's set but never echoed back, e.g. a password or API
+ key) is replaced with ``PASSWORD_MASK`` here rather than returned in the
+ clear.
+ """
+ cls = registry.get(layer.type)
+ if not cls:
+ return config
+
+ try:
+ schema = cls.get_configuration_schema()
+ except Exception: # pylint: disable=broad-except
+ return config
Review Comment:
Fair catch, a schema load failure was falling through to unmasked config.
Fixed to fail closed and mask everything when the schema can't load.
##########
superset/semantic_layers/api.py:
##########
@@ -677,6 +711,9 @@ def runtime_schema(self, uuid: str) -> FlaskResponse:
404:
$ref: '#/components/responses/404'
"""
+ if not is_feature_enabled("SEMANTIC_LAYERS"):
Review Comment:
That pattern predates this PR, this diff only adds the feature-flag check
above it. Broader dedup would touch a lot more than what's in scope here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
