Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't replace environment variables and system properties in get table configs REST API #14002

Merged

Conversation

yashmayya
Copy link
Collaborator

  • Fixes Environment variables in table configs are revealed #13983
  • When the table configs are stored in ZK, the environment variables and system properties are stored as is (i.e., without replacing with actual values).
  • However, the table config retrieval REST APIs use an internal ZK metadata API that replaces these variables with their actual values for use internally within Pinot.
  • This shouldn't be the case for the user facing REST API since these values could contain secrets.

@codecov-commenter
Copy link

codecov-commenter commented Sep 16, 2024

Codecov Report

Attention: Patch coverage is 18.75000% with 13 lines in your changes missing coverage. Please review.

Project coverage is 57.91%. Comparing base (59551e4) to head (c9da03b).
Report is 1037 commits behind head on master.

Files with missing lines Patch % Lines
...ache/pinot/common/metadata/ZKMetadataProvider.java 0.00% 10 Missing ⚠️
...ntroller/helix/core/PinotHelixResourceManager.java 25.00% 3 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##             master   #14002      +/-   ##
============================================
- Coverage     61.75%   57.91%   -3.84%     
- Complexity      207      219      +12     
============================================
  Files          2436     2613     +177     
  Lines        133233   143278   +10045     
  Branches      20636    21996    +1360     
============================================
+ Hits          82274    82976     +702     
- Misses        44911    53812    +8901     
- Partials       6048     6490     +442     
Flag Coverage Δ
custom-integration1 <0.01% <0.00%> (-0.01%) ⬇️
integration <0.01% <0.00%> (-0.01%) ⬇️
integration1 <0.01% <0.00%> (-0.01%) ⬇️
integration2 0.00% <0.00%> (ø)
java-11 57.86% <18.75%> (-3.85%) ⬇️
java-21 57.78% <18.75%> (-3.84%) ⬇️
skip-bytebuffers-false 57.90% <18.75%> (-3.85%) ⬇️
skip-bytebuffers-true 57.74% <18.75%> (+30.01%) ⬆️
temurin 57.91% <18.75%> (-3.84%) ⬇️
unittests 57.90% <18.75%> (-3.84%) ⬇️
unittests1 40.71% <0.00%> (-6.18%) ⬇️
unittests2 27.97% <18.75%> (+0.24%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@yashmayya yashmayya marked this pull request as ready for review September 16, 2024 07:21
@ankitsultana ankitsultana added the backward-incompat Referenced by PRs that introduce or fix backward compat issues label Sep 17, 2024
@Jackie-Jiang Jackie-Jiang merged commit 4a7a1cd into apache:master Sep 18, 2024
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backward-incompat Referenced by PRs that introduce or fix backward compat issues bugfix rest-api security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Environment variables in table configs are revealed
4 participants