bito-code-review[bot] commented on PR #43783:
URL: https://github.com/apache/superset/pull/43783#issuecomment-5503492987
<!-- Bito Reply -->
The security concern regarding the exposure of connection metadata is
addressed by the changes in this pull request. The implementation introduces
`mask_configuration` in the `_serialize_layer` function within
`superset/semantic_layers/api.py`, which ensures that sensitive credential
fields are masked before the configuration payload is returned to the client.
Additionally, the `SemanticLayer` model has been added to
`READ_ONLY_MODEL_VIEWS` in `superset/security/manager.py`, restricting write
operations to administrators and ensuring that read operations are handled
through the masking logic.
**superset/semantic_layers/api.py**
```
# A layer configuration is a credentialed connection payload; it
# never leaves the server with its secret fields readable. Clients
# editing a layer echo the mask back and the update command swaps
# the stored secrets in (see ``masking.unmask_configuration``).
"configuration": mask_configuration(layer.type, config or {}),
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
