This is an automated email from the ASF dual-hosted git repository.
jt2594838 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/master by this push:
new 510c8cddd2b Fix pipe visibility and mask credentials in show create
(#18617)
510c8cddd2b is described below
commit 510c8cddd2b35484e2c730798d41761bcf766ff0
Author: Caideyipi <[email protected]>
AuthorDate: Fri Sep 11 09:29:13 2026 +0800
Fix pipe visibility and mask credentials in show create (#18617)
---
.../pipe/it/single/IoTDBPipePermissionIT.java | 9 ++++-
.../response/pipe/task/PipeTableResp.java | 8 ++--
.../metadata/relational/ShowCreatePipeTask.java | 7 +++-
.../metadata/relational/ShowCreateTaskTest.java | 46 +++++++++++++++++++---
4 files changed, 58 insertions(+), 12 deletions(-)
diff --git
a/integration-test/src/test/java/org/apache/iotdb/pipe/it/single/IoTDBPipePermissionIT.java
b/integration-test/src/test/java/org/apache/iotdb/pipe/it/single/IoTDBPipePermissionIT.java
index 96870b0329b..2ab00c52f9f 100644
---
a/integration-test/src/test/java/org/apache/iotdb/pipe/it/single/IoTDBPipePermissionIT.java
+++
b/integration-test/src/test/java/org/apache/iotdb/pipe/it/single/IoTDBPipePermissionIT.java
@@ -115,7 +115,7 @@ public class IoTDBPipePermissionIT extends
AbstractPipeSingleIT {
try (final Connection connection =
env.getConnection(BaseEnv.TABLE_SQL_DIALECT);
final Statement statement = connection.createStatement()) {
statement.execute(
- "alter pipe a2b modify sink ('username'='thulab',
'password'='StrngPsWd@623451')");
+ "alter pipe a2b modify sink ('sink.username'='thulab',
'sink.password'='StrngPsWd@623451')");
} catch (final SQLException e) {
e.printStackTrace();
fail("Alter pipe shall not fail if user and password are specified");
@@ -187,6 +187,13 @@ public class IoTDBPipePermissionIT extends
AbstractPipeSingleIT {
final ResultSet result = statement.executeQuery("show pipes");
Assert.assertTrue(result.next());
Assert.assertFalse(result.next());
+
+ final ResultSet showCreateResult = statement.executeQuery("show create
pipe a2b");
+ Assert.assertTrue(showCreateResult.next());
+ Assert.assertTrue(
+ showCreateResult.getString("Create
Pipe").contains("'sink.password'='******'"));
+ Assert.assertFalse(showCreateResult.getString("Create
Pipe").contains("StrngPsWd@623451"));
+ Assert.assertFalse(showCreateResult.next());
} catch (Exception e) {
fail(e.getMessage());
}
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/consensus/response/pipe/task/PipeTableResp.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/consensus/response/pipe/task/PipeTableResp.java
index 153fae0f9b7..474d5f0bc2f 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/consensus/response/pipe/task/PipeTableResp.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/consensus/response/pipe/task/PipeTableResp.java
@@ -179,10 +179,10 @@ public class PipeTableResp implements DataSet {
return Objects.equals(
userName,
sinkParameters.getStringByKeys(
- PipeSourceConstant.EXTRACTOR_IOTDB_USER_KEY,
- PipeSourceConstant.SOURCE_IOTDB_USER_KEY,
- PipeSourceConstant.EXTRACTOR_IOTDB_USERNAME_KEY,
- PipeSourceConstant.SOURCE_IOTDB_USERNAME_KEY));
+ PipeSinkConstant.CONNECTOR_IOTDB_USER_KEY,
+ PipeSinkConstant.SINK_IOTDB_USER_KEY,
+ PipeSinkConstant.CONNECTOR_IOTDB_USERNAME_KEY,
+ PipeSinkConstant.SINK_IOTDB_USERNAME_KEY));
}
public TGetAllPipeInfoResp convertToTGetAllPipeInfoResp() throws IOException
{
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/metadata/relational/ShowCreatePipeTask.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/metadata/relational/ShowCreatePipeTask.java
index 80cab3aa004..43b71ab7d2a 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/metadata/relational/ShowCreatePipeTask.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/metadata/relational/ShowCreatePipeTask.java
@@ -30,6 +30,7 @@ import
org.apache.iotdb.db.queryengine.common.header.DatasetHeaderFactory;
import org.apache.iotdb.db.queryengine.plan.execution.config.ConfigTaskResult;
import org.apache.iotdb.db.queryengine.plan.execution.config.IConfigTask;
import
org.apache.iotdb.db.queryengine.plan.execution.config.executor.IConfigTaskExecutor;
+import org.apache.iotdb.pipe.api.customizer.parameter.PipeParameters;
import org.apache.iotdb.rpc.TSStatusCode;
import com.google.common.util.concurrent.ListenableFuture;
@@ -47,6 +48,8 @@ import java.util.stream.Collectors;
public class ShowCreatePipeTask implements IConfigTask {
+ private static final String HIDDEN_VALUE = "******";
+
private final String pipeName;
private final String userName;
@@ -167,10 +170,12 @@ public class ShowCreatePipeTask implements IConfigTask {
}
final List<String> pairs = new ArrayList<>(attributes.size());
for (final Map.Entry<String, String> entry : attributes.entrySet()) {
+ final String value =
+ PipeParameters.ValueHider.isHiddenKey(entry.getKey()) ? HIDDEN_VALUE
: entry.getValue();
pairs.add(
ShowCreateTableTask.getString(entry.getKey())
+ "="
- + ShowCreateTableTask.getString(entry.getValue()));
+ + ShowCreateTableTask.getString(value));
}
builder.append(" ").append(clause).append(" (").append(String.join(",",
pairs)).append(")");
}
diff --git
a/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/execution/config/metadata/relational/ShowCreateTaskTest.java
b/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/execution/config/metadata/relational/ShowCreateTaskTest.java
index bec51507da1..3f698dacddd 100644
---
a/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/execution/config/metadata/relational/ShowCreateTaskTest.java
+++
b/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/execution/config/metadata/relational/ShowCreateTaskTest.java
@@ -39,6 +39,7 @@ import java.util.HashMap;
import java.util.Map;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
public class ShowCreateTaskTest {
@@ -114,7 +115,7 @@ public class ShowCreateTaskTest {
}
@Test
- public void testShowCreatePipeSQLShouldKeepExplicitCredentials() {
+ public void testShowCreatePipeSQLShouldMaskExplicitCredentials() {
final Map<String, String> sourceAttributes = new HashMap<>();
sourceAttributes.put(PipeSourceConstant.SOURCE_KEY, "iotdb-source");
sourceAttributes.put(PipeSourceConstant.SOURCE_IOTDB_USERNAME_KEY,
"alice");
@@ -136,13 +137,13 @@ public class ShowCreateTaskTest {
assertEquals(
"CREATE PIPE \"test_pipe\""
- + " WITH SOURCE
('source'='iotdb-source','source.password'='secret','source.username'='alice')"
- + " WITH SINK
('sink'='write-back-sink','sink.password'='secret','sink.username'='alice')",
+ + " WITH SOURCE
('source'='iotdb-source','source.password'='******','source.username'='alice')"
+ + " WITH SINK
('sink'='write-back-sink','sink.password'='******','sink.username'='alice')",
ShowCreatePipeTask.getShowCreatePipeSQL(pipeMeta));
}
@Test
- public void
testShowCreatePipeSQLShouldKeepExplicitCredentialsWhenInjectionMarkerIsReset() {
+ public void
testShowCreatePipeSQLShouldMaskExplicitCredentialsWhenInjectionMarkerIsReset() {
final Map<String, String> sourceAttributes = new HashMap<>();
sourceAttributes.put(PipeSourceConstant.SOURCE_KEY, "iotdb-source");
sourceAttributes.put(PipeSourceConstant.SOURCE_IOTDB_USERNAME_KEY,
"alice");
@@ -170,11 +171,44 @@ public class ShowCreateTaskTest {
assertEquals(
"CREATE PIPE \"test_pipe\""
- + " WITH SOURCE
('source'='iotdb-source','source.password'='secret','source.username'='alice')"
- + " WITH SINK
('sink'='write-back-sink','sink.password'='secret','sink.username'='alice')",
+ + " WITH SOURCE
('source'='iotdb-source','source.password'='******','source.username'='alice')"
+ + " WITH SINK
('sink'='write-back-sink','sink.password'='******','sink.username'='alice')",
ShowCreatePipeTask.getShowCreatePipeSQL(pipeMeta));
}
+ @Test
+ public void testShowCreatePipeSQLShouldMaskSensitiveAliasAttributes() {
+ final Map<String, String> sourceAttributes = new HashMap<>();
+ sourceAttributes.put(PipeSourceConstant.EXTRACTOR_KEY, "iotdb-extractor");
+ sourceAttributes.put(PipeSourceConstant.EXTRACTOR_IOTDB_PASSWORD_KEY,
"source-secret");
+ sourceAttributes.put("extractor.ssl.key-store-pwd", "key-store-secret");
+
+ final Map<String, String> sinkAttributes = new HashMap<>();
+ sinkAttributes.put(PipeSinkConstant.CONNECTOR_KEY,
"iotdb-thrift-connector");
+ sinkAttributes.put(PipeSinkConstant.CONNECTOR_IOTDB_PASSWORD_KEY,
"sink-secret");
+
+ final PipeMeta pipeMeta =
+ new PipeMeta(
+ new PipeStaticMeta("test_pipe", 1L, sourceAttributes, new
HashMap<>(), sinkAttributes),
+ new PipeRuntimeMeta());
+
+ final String sql = ShowCreatePipeTask.getShowCreatePipeSQL(pipeMeta);
+ assertEquals(3, countOccurrences(sql, "******"));
+ assertFalse(sql.contains("source-secret"));
+ assertFalse(sql.contains("key-store-secret"));
+ assertFalse(sql.contains("sink-secret"));
+ }
+
+ private static int countOccurrences(final String value, final String
searchedValue) {
+ int count = 0;
+ int index = 0;
+ while ((index = value.indexOf(searchedValue, index)) >= 0) {
+ count++;
+ index += searchedValue.length();
+ }
+ return count;
+ }
+
@Test
public void
testShowCreatePipeSQLShouldSanitizeExtractorAndConnectorAliases() {
final Map<String, String> sourceAttributes = new HashMap<>();
