det101 commented on PR #18585:
URL:
https://github.com/apache/dolphinscheduler/pull/18585#issuecomment-5449413554
Thanks for the review. Both P1s are addressed, with a few extra hardening
changes.
1. **Version-list APIs**
`GET .../task-definition/{code}/versions` and `GET
.../workflow-definition/{code}/versions` now mask sensitive `taskParams` /
`globalParams`. Following the deep-copy approach you suggested, masking is
applied to JSON copies (`copyAndMask*`) so MyBatis-mapped log entities are not
mutated in place. Regression tests cover both endpoints and assert the original
records stay unmasked.
2. **Old workflow instance update**
`WorkflowInstanceServiceImpl.mergeSensitiveLocalParams` no longer uses
`taskDefinitionDao.queryByCodes()`. It restores `******` from
`TaskDefinitionLog` by **code + version**. To avoid N+1 queries it uses a
single `queryByTaskDefinitions` call, with a `List` of keys
(`TaskDefinition.equals()` ignores code/version, so a `Set` would collapse
distinct versions). A regression test updates an old instance after the current
task secret has changed and asserts the matching version value is kept.
3. **Extra hardening**
- `maskWorkflowDefinition` / `maskTaskDefinition` now clear the cached
`globalParamMap` / `taskParamMap`, because `setGlobalParams` does not rebuild
the map and getters could still return plaintext.
- Workflow *definition* update still merges against the current
definition via `queryByCodes()`, because that path edits the live definition
rather than an old instance.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
