rusackas commented on code in PR #43393:
URL: https://github.com/apache/superset/pull/43393#discussion_r3832249873
##########
superset/commands/database/importers/v1/utils.py:
##########
@@ -81,7 +144,13 @@ def import_database( # noqa: C901
# For existing DBs, reveal masked sensitive values from current
encrypted_extra.
# For new DBs, schema validation already ensured no fields are still
masked.
if masked_encrypted_extra := config.pop("masked_encrypted_extra", None):
- if existing and existing.encrypted_extra:
+ # Never reveal stored encrypted_extra secrets into a config that
+ # repoints the connection at a different endpoint.
+ if (
+ existing
+ and existing.encrypted_extra
+ and not _connection_identity_changed(existing, config)
+ ):
Review Comment:
Good catch, fixed. Added coverage for the SSH tunnel repoint-blocking path
(both plain password and private_key/private_key_password), plus a case for the
encrypted_extra guard on a host change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
