This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.1 by this push:
new b0a79b27bb2 branch-4.1: [fix](security) Mask sensitive fields in
encryption keys schema table #66834 (#66931)
b0a79b27bb2 is described below
commit b0a79b27bb278ff3737f6a5b6e83160e56425221
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Thu Aug 20 09:10:14 2026 +0800
branch-4.1: [fix](security) Mask sensitive fields in encryption keys schema
table #66834 (#66931)
Cherry-picked from #66834
Co-authored-by: dzr171712 <[email protected]>
---
.../schema_encryption_keys_scanner.cpp | 6 ++----
.../schema_encryption_keys_scanner_test.cpp | 17 +++++++++++++++--
2 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/be/src/information_schema/schema_encryption_keys_scanner.cpp
b/be/src/information_schema/schema_encryption_keys_scanner.cpp
index eaaa746202e..6766d89409d 100644
--- a/be/src/information_schema/schema_encryption_keys_scanner.cpp
+++ b/be/src/information_schema/schema_encryption_keys_scanner.cpp
@@ -161,12 +161,10 @@ Status
SchemaEncryptionKeysScanner::_fill_block_impl(Block* block) {
}
break;
case 6:
- column_value = encryption_key.has_iv_base64() ?
encryption_key.iv_base64() : "";
+ column_value = encryption_key.has_iv_base64() ? "******" :
"";
break;
case 7:
- column_value = encryption_key.has_ciphertext_base64()
- ? encryption_key.ciphertext_base64()
- : "";
+ column_value = encryption_key.has_ciphertext_base64() ?
"******" : "";
break;
}
diff --git
a/be/test/exec/schema_scanner/schema_encryption_keys_scanner_test.cpp
b/be/test/exec/schema_scanner/schema_encryption_keys_scanner_test.cpp
index 7332ff3c3be..55e16481036 100644
--- a/be/test/exec/schema_scanner/schema_encryption_keys_scanner_test.cpp
+++ b/be/test/exec/schema_scanner/schema_encryption_keys_scanner_test.cpp
@@ -33,13 +33,26 @@ class ScheamEncryptionKeysScannerTest : public
testing::Test {
TEST_F(ScheamEncryptionKeysScannerTest, test_get_next_block_internal) {
SchemaEncryptionKeysScanner scanner;
auto& keys = scanner._master_keys;
- EncryptionKeyPB key;
- keys.push_back(key);
+ keys.emplace_back();
+ EncryptionKeyPB key_with_sensitive_values;
+ key_with_sensitive_values.set_iv_base64("sensitive iv");
+ key_with_sensitive_values.set_ciphertext_base64("sensitive cipher");
+ keys.push_back(key_with_sensitive_values);
auto data_block = Block::create_unique();
scanner._init_block(data_block.get());
auto st = scanner._fill_block_impl(data_block.get());
+ ASSERT_EQ(Status::OK(), st);
+ ASSERT_EQ(2, data_block->rows());
+
+ const auto& iv_column = data_block->safe_get_by_position(6).column;
+ EXPECT_EQ("", (*iv_column)[0].get<TYPE_STRING>());
+ EXPECT_EQ("******", (*iv_column)[1].get<TYPE_STRING>());
+
+ const auto& cipher_column = data_block->safe_get_by_position(7).column;
+ EXPECT_EQ("", (*cipher_column)[0].get<TYPE_STRING>());
+ EXPECT_EQ("******", (*cipher_column)[1].get<TYPE_STRING>());
}
} // namespace doris
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
