yujunjun/datahub
2
0
Fork 0
mirror of https://github.com/datahub-project/datahub.git synced 2025-08-27 10:35:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(test): fix sensitive properties test (#14407)

Browse Source
This commit is contained in:
david-leifker 2025-08-08 19:27:09 -05:00 committed by GitHub
parent dbe5dafedc
commit d817d6bbff
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 26 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
metadata-io/src/main/java/com/linkedin/metadata/system_info/collectors/PropertiesCollector.java
View File

@ -49,7 +49,12 @@ public class PropertiesCollector {
private static final Set<Pattern> ALLOWED_PATTERNS =
compilePatterns(
Set.of(
"cache\\.client\\..*" // Allow all cache.client.* properties
"cache\\.client\\..*", // Allow all cache.client.* properties
".*\\.(delay|interval|timeout|duration|initial|max|wait).*ms$", // Allow specific ms
// properties
".*\\.limit$", // Allow properties ending with .limit
".*\\.max$", // Allow properties ending with .max
".*\\.\\w*size$" // Allow properties ending with .pageSize .batchSize
));
/**
@ -120,7 +125,7 @@ public class PropertiesCollector {
String resolvedValue = springEnvironment.getProperty(k);
// Check if this is an allowed property
if (isAllowedProperty(k)) {
if (isAllowedProperty(k, resolvedValue)) {
return PropertyInfo.builder()
.key(k)
.value(rawValue)
@ -170,9 +175,14 @@ public class PropertiesCollector {
return sources;
}
private boolean isAllowedProperty(String key) {
private boolean isAllowedProperty(String key, String value) {
String lowerKey = key.toLowerCase();
return ALLOWED_PATTERNS.stream().anyMatch(pattern -> pattern.matcher(lowerKey).find())
// Check if value is a boolean
boolean isBooleanValue =
value != null && (value.equalsIgnoreCase("true") || value.equalsIgnoreCase("false"));
return isBooleanValue
|| ALLOWED_PATTERNS.stream().anyMatch(pattern -> pattern.matcher(lowerKey).find())
|| SENSITIVE_PATTERNS.stream().noneMatch(lowerKey::endsWith);
}
}

17
metadata-io/src/test/java/com/linkedin/metadata/system_info/collectors/PropertiesCollectorConfigurationTest.java
View File

@ -74,10 +74,6 @@ public class PropertiesCollectorConfigurationTest extends AbstractTestNGSpringCo
// Services encryption
"secretService.encryptionKey",
// Authentication mode settings that can contain sensitive data
"ebean.postgresUseIamAuth",
"elasticsearch.opensearchUseAwsIamAuth",
// Environment variables that may contain sensitive paths/credentials
"GIT_ASKPASS", // Can contain path to credential helper
"PWD" // Current directory may contain sensitive info
@ -115,7 +111,15 @@ public class PropertiesCollectorConfigurationTest extends AbstractTestNGSpringCo
"cache.client.entityClient.entityAspectTTLSeconds.*.*",
// Gradle test worker properties (Java system properties)
"org.gradle.test.worker*");
"org.gradle.test.worker*",
// System update properties
"systemUpdate.*.enabled",
"systemUpdate.*.batchSize",
// IAM authentication flags
"*.postgresUseIamAuth",
"*.opensearchUseAwsIamAuth");
/**
* Property keys that should NOT be redacted. Add new non-sensitive properties here when they are
@ -317,8 +321,11 @@ public class PropertiesCollectorConfigurationTest extends AbstractTestNGSpringCo
"socksNonProxyHosts",
// Java system properties
"apple.awt.application.name",
"file.encoding",
"file.separator",
"stderr.encoding",
"stdout.encoding",
"java.awt.headless",
"java.class.path",
"java.class.version",