bito-code-review[bot] commented on PR #44003:
URL: https://github.com/apache/superset/pull/44003#issuecomment-5587602337
<!-- Bito Reply -->
The flagged issue is correct. The current implementation of
`_check_no_unsafe_secret_rebind` in `superset/commands/database/update.py` only
checks for `PASSWORD_MASK` or `None` in the `sqlalchemy_uri` password field
when a destination change is detected. It fails to account for cases where the
password might be stored in `encrypted_extra` (which is common for engines that
store authentication outside the URI).
To resolve this, you should update the check to also verify if
`encrypted_extra` is being reused (i.e., remains masked) when a destination
change occurs.
Would you like me to fetch all other comments on this PR to validate and
implement fixes for them as well?
**superset/commands/database/update.py**
```
if connection_identity_changed and (
submitted_password in (None, PASSWORD_MASK)
or self._properties.get("encrypted_extra") == PASSWORD_MASK
):
raise
DatabaseInvalidError(exceptions=[DatabaseUpdateUnsafeRebindError()])
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
