(hop) branch main updated: fix(execution): exclude parameterValues from Execution JSON serialization (#8027)

[hansva]

This is an automated email from the ASF dual-hosted git repository.

hansva pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/hop.git


The following commit(s) were added to refs/heads/main by this push:
     new 46be47b043 fix(execution): exclude parameterValues from Execution JSON 
serialization (#8027)
46be47b043 is described below

commit 46be47b04345646257820437c46238e05dfd4c7f
Author: zanarelli <zanarelli....@gmail.com>
AuthorDate: Fri Aug 21 04:15:42 2026 -0300

    fix(execution): exclude parameterValues from Execution JSON serialization 
(#8027)
    
    Execution.parameterValues carried no @JsonIgnore while the sibling
    variableValues field was already deprecated and JsonIgnore'd for the same
    reason: this class is serialized wholesale to JSON by 
GetExecutionInfoServlet
    and the REST LocationResource, and pipeline/workflow parameters routinely
    carry secrets (DB passwords, API tokens).
    
    Add @JsonIgnore to parameterValues, matching the existing variableValues
    protection. This only affects JSON (de)serialization; in-process consumers
    (BaseExecutionViewer, WorkflowExecutionViewer, PipelineExecutionViewer) read
    the values directly via the Java getter and are unaffected.
    
    Signed-off-by: zanarelli <zanarelli....@gmail.com>
---
 .../java/org/apache/hop/execution/Execution.java   |  2 +-
 .../org/apache/hop/execution/ExecutionTest.java    | 50 ++++++++++++++++++++++
 2 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/engine/src/main/java/org/apache/hop/execution/Execution.java 
b/engine/src/main/java/org/apache/hop/execution/Execution.java
index fd4aa595b5..4cb53f4400 100644
--- a/engine/src/main/java/org/apache/hop/execution/Execution.java
+++ b/engine/src/main/java/org/apache/hop/execution/Execution.java
@@ -81,7 +81,7 @@ public class Execution {
   private LogLevel logLevel;
 
   /** The parameters used to execute */
-  private Map<String, String> parameterValues;
+  @JsonIgnore private Map<String, String> parameterValues;
 
   /** Details about the environment */
   private Map<String, String> environmentDetails;
diff --git a/engine/src/test/java/org/apache/hop/execution/ExecutionTest.java 
b/engine/src/test/java/org/apache/hop/execution/ExecutionTest.java
new file mode 100644
index 0000000000..a14266eccc
--- /dev/null
+++ b/engine/src/test/java/org/apache/hop/execution/ExecutionTest.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.apache.hop.execution;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.StringWriter;
+import java.util.Map;
+import org.apache.hop.core.json.HopJson;
+import org.junit.jupiter.api.Test;
+
+class ExecutionTest {
+
+  @Test
+  void testParameterValuesNotSerialized() throws Exception {
+    Execution execution = new Execution();
+    execution.setName("test-execution");
+    execution.setParameterValues(Map.of("dbPassword", "shouldNeverLeak"));
+    execution.setVariableValues(Map.of("apiToken", "shouldAlsoNeverLeak"));
+
+    StringWriter writer = new StringWriter();
+    HopJson.newMapper().writeValue(writer, execution);
+    String json = writer.toString();
+
+    assertFalse(
+        json.contains("shouldNeverLeak"),
+        "parameterValues must not appear in serialized JSON, same as 
variableValues");
+    assertFalse(json.contains("shouldAlsoNeverLeak"), "variableValues must not 
be serialized");
+    assertFalse(json.contains("parameterValues"), "parameterValues key must 
not be serialized");
+    assertFalse(json.contains("variableValues"), "variableValues key must not 
be serialized");
+    assertTrue(json.contains("test-execution"), "other fields must still 
serialize normally");
+  }
+}