younsl opened a new pull request, #437:
URL: https://github.com/apache/superset-kubernetes-operator/pull/437
## Summary
The credential redaction used for lifecycle task failure messages only
masked part of a quoted-key value when the value started with empty quotes
followed by more characters. For example, {"password": ""hunter2} became
{"password": ***hunter2}, and the leftover text was written to status.lifecycle
and Events. This PR makes the quoted forms of quotedKeyCredentialRe also take
the characters glued to the closing quote, so the whole value is masked.
cc @villebro, since this builds on the quoted-key handling you added in
#331. The pattern shipped in v0.3.0, so this may be worth a patch release.
## Details
- Regex: the double-quote and single-quote alternatives now continue through
non-delimiter characters after the closing quote. Bare values and normal quoted
values give the same output as before.
- Fuzz: the fuzz target found this case through its idempotence check (the
second pass masked the leftover text). The failing input is added as a
regression seed in FuzzRedactCredentials, following the existing f.Add pattern.
- Unit tests: two new cases cover the double-quote and single-quote forms.
Both fail without the regex change and pass with it.
| Input | Before | After |
|---|---|---|
| {"password": ""hunter2} | {"password": ***hunter2} | {"password": ***} |
| {"password": ''hunter2, "port": 5432} | {"password": ***hunter2, "port":
5432} | {"password": ***, "port": 5432} |
| {"password": "hunter2"} | {"password": ***} | {"password": ***} |
Verification: make lint-go (0 issues), make test-unit (all packages pass),
and 60 seconds of fuzzing on FuzzRedactCredentials with no failures.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
