lasdf1234 opened a new pull request, #13295:
URL: https://github.com/apache/gravitino/pull/13295
### What changes were proposed in this pull request?
- Add `SensitivePropertyKeyMatcher` to extend #12983 name-based credential
detection with:
- configured typo substrings
(`gravitino.properties.sensitive-key-typo-patterns`)
- optional Damerau-Levenshtein fuzzy matching against canonical credential
keywords and configured typo patterns
(`gravitino.properties.sensitive-key-fuzzy-match-max-distance`, default `1`)
- Initialize matcher from server config in `GravitinoEnv`
- Document the new settings in `gravitino.conf.template`
- Add unit tests for typo/fuzzy matching paths
### Why are the changes needed?
#12983 masks and recovers credential-like properties when the key name
contains keywords such as `password` or `secret`. Common typos like
`jdbc-passwrod` bypass that substring check and can still leak plaintext on
list/get APIs. Operators should be able to declare known typos and enable fuzzy
matching so mistyped credential keys follow the same masking / `getSecrets`
recovery behavior.
Fix: #13294
### Does this PR introduce _any_ user-facing change?
Yes.
1. New server configuration keys:
- `gravitino.properties.sensitive-key-typo-patterns`
- `gravitino.properties.sensitive-key-fuzzy-match-max-distance`
2. With default fuzzy distance `1`, mistyped credential-like keys (for
example `jdbc-passwrod`) are masked as `******` and recovered via `getSecrets`.
### How was this patch tested?
```bash
./gradlew :core:spotlessApply
./gradlew :core:test \
--tests 'org.apache.gravitino.secret.TestSensitivePropertyKeyMatcher' \
--tests 'org.apache.gravitino.secret.TestSecretPropertyUtils' \
--tests 'org.apache.gravitino.connector.TestHiddenPropertyMaskUtils' \
-PskipITs
```
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
