-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Introduce redaction for sensitive statements
This commit introduces redacting of security-sensitive information in statements containing connector properties, specifically: * CREATE CATALOG * EXPLAIN CREATE CATALOG * EXPLAIN ANALYZE CREATE CATALOG The current approach is as follows: * For syntactically valid statements, only properties containing sensitive information are masked. * If a valid query references a nonexistent connector, all properties are masked. * If a query fails before or during parsing, the entire query is masked The redacted form is created in DispatchManager and is propagated to all places that create QueryInfo and BasicQueryInfo. Before this change, QueryInfo/BasicQueryInfo stored the raw query text received from the end user. From now on, the text will be altered for the cases listed above.
- Loading branch information
1 parent
8018b45
commit 11a7ed1
Showing
11 changed files
with
415 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
131 changes: 131 additions & 0 deletions
131
core/trino-main/src/main/java/io/trino/sql/SensitiveStatementRedactor.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,131 @@ | ||
| /* | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package io.trino.sql; | ||
|
|
||
| import com.google.inject.Inject; | ||
| import io.trino.FeaturesConfig; | ||
| import io.trino.connector.CatalogFactory; | ||
| import io.trino.spi.connector.ConnectorName; | ||
| import io.trino.sql.tree.AstVisitor; | ||
| import io.trino.sql.tree.CreateCatalog; | ||
| import io.trino.sql.tree.Explain; | ||
| import io.trino.sql.tree.ExplainAnalyze; | ||
| import io.trino.sql.tree.Identifier; | ||
| import io.trino.sql.tree.Node; | ||
| import io.trino.sql.tree.Property; | ||
| import io.trino.sql.tree.Statement; | ||
| import io.trino.sql.tree.StringLiteral; | ||
|
|
||
| import java.util.List; | ||
| import java.util.Set; | ||
|
|
||
| import static com.google.common.collect.ImmutableList.toImmutableList; | ||
| import static com.google.common.collect.ImmutableSet.toImmutableSet; | ||
|
|
||
| public class SensitiveStatementRedactor | ||
| { | ||
| public static final String REDACTED_VALUE = "***"; | ||
|
|
||
| private final boolean enabled; | ||
| private final CatalogFactory catalogFactory; | ||
|
|
||
| @Inject | ||
| public SensitiveStatementRedactor(FeaturesConfig config, CatalogFactory catalogFactory) | ||
| { | ||
| this.enabled = config.isStatementRedactingEnabled(); | ||
| this.catalogFactory = catalogFactory; | ||
| } | ||
|
|
||
| public String redact(String rawQuery, Statement statement) | ||
| { | ||
| if (enabled) { | ||
| RedactingVisitor visitor = new RedactingVisitor(); | ||
| Node redactedStatement = visitor.process(statement); | ||
| if (visitor.isRedacted()) { | ||
| return SqlFormatter.formatSql(redactedStatement); | ||
| } | ||
| } | ||
| return rawQuery; | ||
| } | ||
|
|
||
| public String redact(String rawQuery) | ||
| { | ||
| if (enabled) { | ||
| return REDACTED_VALUE; | ||
| } | ||
| return rawQuery; | ||
| } | ||
|
|
||
| private class RedactingVisitor | ||
| extends AstVisitor<Node, Void> | ||
| { | ||
| private boolean redacted; | ||
|
|
||
| public boolean isRedacted() | ||
| { | ||
| return redacted; | ||
| } | ||
|
|
||
| @Override | ||
| protected Node visitNode(Node node, Void context) | ||
| { | ||
| return node; | ||
| } | ||
|
|
||
| @Override | ||
| protected Node visitExplain(Explain explain, Void context) | ||
| { | ||
| Statement statement = (Statement) process(explain.getStatement()); | ||
| return new Explain(explain.getLocation().orElseThrow(), statement, explain.getOptions()); | ||
| } | ||
|
|
||
| @Override | ||
| protected Node visitExplainAnalyze(ExplainAnalyze explainAnalyze, Void context) | ||
| { | ||
| Statement statement = (Statement) process(explainAnalyze.getStatement()); | ||
| return new ExplainAnalyze(explainAnalyze.getLocation().orElseThrow(), statement, explainAnalyze.isVerbose()); | ||
| } | ||
|
|
||
| @Override | ||
| protected Node visitCreateCatalog(CreateCatalog createCatalog, Void context) | ||
| { | ||
| ConnectorName connectorName = new ConnectorName(createCatalog.getConnectorName().getValue()); | ||
| List<Property> redactedProperties = redact(connectorName, createCatalog.getProperties()); | ||
| return createCatalog.withProperties(redactedProperties); | ||
| } | ||
|
|
||
| private List<Property> redact(ConnectorName connectorName, List<Property> properties) | ||
| { | ||
| redacted = true; | ||
| Set<String> propertyNames = properties.stream() | ||
| .map(Property::getName) | ||
| .map(Identifier::getValue) | ||
| .collect(toImmutableSet()); | ||
| Set<String> redactableProperties = catalogFactory.getRedactablePropertyNames(connectorName, propertyNames); | ||
| return redactProperties(properties, redactableProperties); | ||
| } | ||
|
|
||
| private List<Property> redactProperties(List<Property> properties, Set<String> redactableProperties) | ||
| { | ||
| return properties.stream() | ||
| .map(property -> { | ||
| if (redactableProperties.contains(property.getName().getValue())) { | ||
| return new Property(property.getName(), new StringLiteral(REDACTED_VALUE)); | ||
| } | ||
| return property; | ||
| }) | ||
| .collect(toImmutableList()); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.