bamaer commented on PR #8737: URL: https://github.com/apache/hop/pull/8737#issuecomment-6021314611
Both points addressed in the latest commit. **[bug] Secrets not named like a secret.** Whether a value is hidden now depends on the field that was read. It is hidden when that field has `@HopMetadataProperty(password = true)` (resolved through the same lookup as the value, so the serialized key and the Java name both work, on metadata, transforms, actions and dotted paths), or when its name ends with one of the secret patterns. Name matching ignores `_`, so `secret_key`, `api_key` and `secret_access_key` match. **[suggestion] `NO_HARDCODED`.** The unconditional branch is removed. A `NO_HARDCODED` rule on a field that is not a secret reports `(current value: ...)` again. DB-001 stays hidden because its field is `password`. **Tests** (`SecretValueInFindingTest`): - `MATCHES_PATTERN` on `accessKey` and on `oauth_jwt_private_key`: value absent - `secret_key` key with no password flag: value absent - composed rule: `actual: hidden` for the `accessKey` clause - non-secret `NO_HARDCODED` rule: still reports the current value - transform (by Java name and by key) and action with a `password = true` field: value absent The new tests fail on the previous commit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
