lasdf1234 opened a new issue, #13294: URL: https://github.com/apache/gravitino/issues/13294
## What would you like to be improved? PR #12983 added name-based masking and `getSecrets` recovery for credential-like property keys whose names contain keywords such as `password`, `secret`, or `token`. That substring matching does **not** cover common typos such as `jdbc-passwrod` (transposed letters) or `oauth2.tokne`. When users mistype a credential property name, the value can still leak in plaintext on list/get APIs because the key is not recognized as sensitive. ## How should we improve? Add Gravitino server configuration for sensitive property key matching: 1. `gravitino.properties.sensitive-key-typo-patterns` — comma-separated typo substrings (for example `passwrod,secert,tokne`). 2. `gravitino.properties.sensitive-key-fuzzy-match-max-distance` — optional Damerau-Levenshtein fuzzy matching against canonical credential keywords and configured typo patterns (default `1`; set `0` to disable). When a property key matches via configured typo substrings or fuzzy matching, it should follow the same masking and `getSecrets` recovery behavior introduced in #12983. ## Context Related: #12982, #12983 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
