Skip to content

[fix](be) Mask sensitive fields in encryption keys schema table - #66834

Open
dzr171712 wants to merge 1 commit into
apache:masterfrom
dzr171712:fix/CIR-27838
Open

[fix](be) Mask sensitive fields in encryption keys schema table#66834
dzr171712 wants to merge 1 commit into
apache:masterfrom
dzr171712:fix/CIR-27838

Conversation

@dzr171712

Copy link
Copy Markdown

What problem does this PR solve?

Issue Number: close #CIR-27838

Related PR: #xxx

Problem Summary:

Querying information_schema.encryption_keys exposes the original Base64-encoded initialization vector and ciphertext through the IV and CIPHER columns.

The schema scanner previously copied iv_base64 and ciphertext_base64 directly into the result block. This change masks both fields with ****** when their values are present, while preserving the existing empty-string behavior when the fields are absent.

A BE unit test is added to verify both the masked-value and empty-value cases.

Release note

None

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason
  • Behavior changed:

    • No.
    • Yes. The IV and CIPHER columns in information_schema.encryption_keys now return ****** instead of exposing their original values.
  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@hello-stephen

Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@dzr171712

Copy link
Copy Markdown
Author

run buildall

1 similar comment
@luwei16

luwei16 commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

run buildall

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants