bito-code-review[bot] commented on PR #43491:
URL: https://github.com/apache/superset/pull/43491#issuecomment-5429023470
<!-- Bito Reply -->
The flagged issue is correct. In `superset/utils/json.py`, when `old_value`
is not found in `old_payload`, the code currently leaves `PASSWORD_MASK` in the
payload. This can lead to the mask being persisted as the actual secret. To
resolve this, you should either remove the masked field from the payload or
raise an error when the secret is missing and cannot be recovered.
Here is a concise fix to remove the masked field if no old value is
available:
```python
# the old payload may not have a value to reveal, e.g. when a
# masked payload is submitted for a database that never
stored
# the corresponding secret; remove the field instead of
persisting the mask
if old_value := match.full_path.find(old_payload):
match.context.value[match.path.fields[0]] =
old_value[0].value
else:
del match.context.value[match.path.fields[0]]
```
I have checked the PR comments, and there are no other pending comments to
address. Would you like me to implement this fix in the file?
**superset/utils/json.py**
```
# the old payload may not have a value to reveal, e.g. when a
# masked payload is submitted for a database that never
stored
# the corresponding secret; remove the field instead of
persisting the mask
if old_value := match.full_path.find(old_payload):
match.context.value[match.path.fields[0]] =
old_value[0].value
else:
del match.context.value[match.path.fields[0]]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
