Skip to content

Commit 6c1c32e

Browse files
committed
Ignore secure vault during secret masking
commit_hash:216085eee6bf6d1fb553f14aef15be8aa2d52767
1 parent 0ac6c9e commit 6c1c32e

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

yt/yql/providers/yt/gateway/native/yql_yt_spec.cpp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -552,7 +552,11 @@ void CheckSpecForSecretsImpl(
552552

553553
YQL_ENSURE(secretMasker);
554554

555-
auto maskedSpecStr = NYT::NodeToYsonString(spec);
555+
// Secure vault is guaranteed not to be exposed by YT
556+
auto cleanSpec = spec.AsMap();
557+
cleanSpec.erase("secure_vault");
558+
auto maskedSpecStr = NYT::NodeToYsonString(cleanSpec);
559+
556560
auto secrets = secretMasker->Mask(maskedSpecStr);
557561
if (!secrets.empty()) {
558562
auto maskedSpecStrBuf = TStringBuf(maskedSpecStr);

0 commit comments

Comments
 (0)