viirya opened a new pull request, #57863: URL: https://github.com/apache/spark/pull/57863
### What changes were proposed in this pull request? `SparkConnectConfigHandler` no longer discloses `spark.connect.authenticate.token` through the Config RPC. Every read path now reports it the way an unset key is reported: `Get` and `GetOption` return no value, `GetWithDefault` returns the caller's default, and `GetAll` omits it. The filtering in `handleGetAll` runs on the full key, before the requested prefix is stripped off the returned keys. ### Why are the changes needed? `SQLConf.mergeSparkConf` copies every `SparkConf` entry into the session config, static ones included, and the Config RPC's read paths apply no denylist, so a client can read the server's pre-shared authentication token back out of it. `RuntimeConfig` already guards writes to static configs; reads are unguarded. For the client-to-server deployment Spark documents this discloses nothing -- the client had to present the token to connect at all. It matters to deployments that put a proxy in front of Spark Connect and treat the token as a proxy-to-server secret while end users authenticate by other means: there, any user the proxy admits can read the token and then reach a server directly. Spark does not promise that property, so this is defense in depth rather than a fix for a Spark vulnerability; a server not handing out its own credential is the better default either way. ### Does this PR introduce _any_ user-facing change? Yes, in a narrow sense: reading `spark.connect.authenticate.token` through a Connect session now behaves as though the key were unset instead of returning the token. No other configuration is affected. ### How was this patch tested? New test in `SparkConnectAuthSuite` (which already runs a server with the token configured) asserting that `get`, `get` with a default, `getOption` and `getAll` all report the key as unset, and that no other entry carries the token's value. A control key set only on the server proves the Config RPC is otherwise working and really is reading server-side configuration. ### Was this patch authored or co-authored using generative AI tooling? Yes, Generated-by: Claude -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
