fix(masking): fixes multi-level nested fields, and hides non-JSON entries #2004
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… rather than shows them anyway, and fixes multi-nested fields
Contributor
Author
|
Hey @AlexisSouquiere could I get a review on this one please? A much smaller changeset which only fixes the issues described so hopefully should be a lot faster to get in than the previous PR! |
AlexisSouquiere
approved these changes
Nov 21, 2024
Collaborator
AlexisSouquiere
left a comment
There was a problem hiding this comment.
Good for me. Thanks for the clarification
Contributor
Author
Thank you! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi! Follow up to previous PR as I realised there were a few small issues after deploying to another environment:
Returning the original values if it isn't JSON-formattable is actually dangerous, as it means if the schema registry is down or if the wrong schema registry is selected in AKHQ in a multi-schema-registry-setup, the binary format data will still show as a String which in most cases still displays some of the sensitive data. To be safe, this means
json_mask_by_defaultwill now ONLY show structured data and anything else will display a placeholder message. This prevents any unwanted data leakage.Fixes multi-level nested objects for the 'mask by default' option. Before we weren't prepending
currentKey. So for example given a request to exposeone.two.three,one.two.threewould still be masked - the filter would have needed to specify justtwo.three(which is incorrect and would also meananother.two.threewould also be unmasked). This fixes it to work as expected, soone.two.threeunmasksone.two.threeand also isn't applied toanother.two.three