Skip to content

Conversation

rwberendsen
Copy link

Problem
When given a multi-line secret in the schemachange-config YAML, it would not be redacted, because just before calling SecretManager.global_redact, the config vars section would be serialised as YAML, adding leading whitespaces to the multiline secret

Proposed solution
Recurse over the config vars section, and redact all strings in it, and only then serialise as YAML. When redacting multiline secrets, preserve newlines.

Minor edits added in

  • The method that was extracting secrets would crash if the value was of a type that did not have the strip() method. Added an explicit raise of a ValueError if a secret is not of type str
  • Added tests for added functionality

Notes
For redacting in SQL queries nothing was changed, as indenting while rendering Jinja templates is under control of the user of schemachange.

@sfc-gh-tmathew sfc-gh-tmathew added the bug Something isn't working label Aug 29, 2025
@sfc-gh-tmathew
Copy link
Collaborator

@rwberendsen We are catching up back on keeping tabs. Could you resolve the conflicts in this PR?

Thank you for your contribution. Apologies for the delay in responding.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants