lasdf1234 opened a new issue, #12947:
URL: https://github.com/apache/gravitino/issues/12947
### Version
main branch
### Describe what's wrong
Catalog create and alter accept undeclared properties. Redaction only
applies to properties declared as hidden in the provider metadata, so a
mistyped credential property name is stored and returned in cleartext on
catalog read and list APIs.
### Error message and/or stacktrace
N/A. The create request succeeds (HTTP 200). The secret is returned verbatim
in the `properties` map.
### How to reproduce
1. Create a Glue catalog using fileset-style property names that Glue does
not declare:
```
POST /api/metalakes/<metalake>/catalogs
{
"name": "glue_probe",
"type": "relational",
"provider": "glue",
"properties": {
"warehouse": "s3://<bucket>/<prefix>",
"aws-region": "us-east-2",
"s3-access-key-id": "AKIA...",
"s3-secret-access-key": "<secret>"
}
}
```
2. Read it back via `GET /api/metalakes/<metalake>/catalogs/glue_probe` or
`GET /api/metalakes/<metalake>/catalogs?details=true`.
3. Observe `s3-secret-access-key` returned in cleartext.
4. The same catalog with declared names `aws-access-key-id` /
`aws-secret-access-key` correctly redacts to `******`.
### Additional context
Prefer rejecting unknown catalog properties at create/alter time (closed
property set for catalogs). Table/schema open property models should remain
unchanged.
Documented connector bypass prefixes (`gravitino.bypass.`, `trino.bypass.`,
`flink.bypass.`, `spark.bypass.`) must remain allowed via prefix declarations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
