geido commented on code in PR #45068:
URL: https://github.com/apache/superset/pull/45068#discussion_r4412426383
##########
superset/commands/dataset/export.py:
##########
@@ -36,6 +37,37 @@
JSON_KEYS = {"params", "template_params", "extra"}
+# Secure Extra blocks a dashboard, chart or dataset bundle carries, so a
promoted
+# dashboard keeps its OAuth2 client and embedded viewer credential. Every
engine
+# masks their secrets (`BaseEngineSpec.encrypted_extra_sensitive_field_paths`).
+_CARRIED_SECURE_EXTRA_KEYS = ("oauth2_client_info", EMBEDDED_CREDENTIALS_KEY)
+
+
+def _carried_secure_extra(masked_encrypted_extra: str | None) -> str | None:
+ """
+ Return the masked Secure Extra blocks a bundle carries, or ``None``.
+
+ Only these Superset-owned blocks, never the rest of Secure Extra: the
bundle
+ is open to anyone who can export a dashboard or dataset, and an engine's
own
+ settings -- client certificates, service-account keys -- are not all
+ registered as sensitive, so masking cannot be relied on to hide them.
+ """
+ if not masked_encrypted_extra:
+ return None
+ try:
+ secure_extra = json.loads(masked_encrypted_extra)
+ except json.JSONDecodeError:
+ return None
+ if not isinstance(secure_extra, dict):
+ return None
+ carried = {
+ key: secure_extra[key]
+ for key in _CARRIED_SECURE_EXTRA_KEYS
+ if secure_extra.get(key)
+ }
Review Comment:
I think this needs a type check before merge. Databricks keeps the base
`$.*` mask, so this carries `{"oauth2_client_info": "XXXXXXXXXX"}`; a fresh
import asks for `$.oauth2_client_info`, saves what's typed as a string, and
`get_oauth2_config()` fails every query with "Invalid input type". Could we
carry a block only when it's still a dict? Flag off, and the same dashboard
imported fine before.
This PR, flags off:
https://github.com/user-attachments/assets/0347858b-cac0-444f-b189-d8c06efd7068
Same steps on master:
https://github.com/user-attachments/assets/221aabaa-689d-4392-968a-7fd4b73fb509
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
