Adalennis opened a new issue, #9284:
URL: https://github.com/apache/hop/issues/9284
### Apache Hop version?
2.20.0
### Java version?
Java 21
### Operating system
macOS
### What happened?
Found while testing the Text chunker on 2.20.0 (code unchanged on main).
`SecretRedaction` redacts values whose field or tag name looks like a
credential, but two common places are missed, so the values are sent to the
embedding model.
**1. Pipeline and workflow parameters**
`HopXmlSupport.formatParameters` does not call `SecretRedaction`. A pipeline
with parameters `DB_PASSWORD` (default `s3cr3t`) and `API_TOKEN` (default
`tok123`), Content type PIPELINE, gives:
p > Overview … Parameters:
- DB_PASSWORD: default=s3cr3t
- API_TOKEN: default=tok123
**2. Name/value variable lists**
In project configs, environment files and run configurations, variables are
stored as `{"name": "API_TOKEN", "value": "tok123"}`.
`HopMetadataJsonParser.redactSecrets` checks the field name (`value`), not the
variable name, so the chunk keeps `"value" : "tok123"` and `"value" : "s3cr3t"`.
Possible fix: redact the default in `formatParameters` with the parameter
name, and in name/value objects check the `name` entry before keeping `value`.
### Issue Priority
Priority: 3
### Issue Component
Component: Hop Gui
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
