Skip to content

[DSIP-105][API][UI] Add Property.sensitive with API/UI masking #18585

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
det101 wants to merge 15 commits into
base: dev
Choose a base branch
from
Open

[DSIP-105][API][UI] Add Property.sensitive with API/UI masking #18585

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
58ef1d0
[Feature-17937][API][UI] Add sensitive workflow and task parameters
det101 Sep 14, 2026
015b5b7
Merge branch 'dev' into feature-17937-sensitive-property-pr1
det101 Sep 14, 2026
11eedbc
[Chore] Retrigger CI
det101 Sep 15, 2026
edecc0d
Merge branch 'dev' into feature-17937-sensitive-property-pr1
det101 Sep 15, 2026
90a9e4a
[Improvement-17937][API] Split sensitive property mask into typed ove…
det101 Sep 15, 2026
ea46d67
[Fix-17937][API] Mask sensitive values in workflow instance commandParam
det101 Sep 16, 2026
9ba9507
[Chore] Retrigger CI
det101 Sep 16, 2026
9cabab9
[Feature-17937][API][UI] Add sensitive workflow and task parameters
det101 Sep 14, 2026
bf5b8f4
[Improvement-17937][API] Split sensitive property mask into typed ove…
det101 Sep 15, 2026
bc252d2
[Fix-17937][API] Mask sensitive values in workflow instance commandParam
det101 Sep 16, 2026
93e5fbc
Merge branch 'dev' into feature-17937-sensitive-property-pr1
det101 Sep 17, 2026
7d05505
Merge branch 'dev' into feature-17937-sensitive-property-pr1
det101 Sep 17, 2026
a56117e
Merge branch 'feature-17937-sensitive-property-pr1' of github.com:det…
det101 Sep 18, 2026
bd8d4b2
[Chore] Retrigger CI
det101 Sep 18, 2026
4f960d7
Merge branch 'dev' into feature-17937-sensitive-property-pr1
det101 Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions ...pi/src/main/java/org/apache/dolphinscheduler/api/controller/TaskDefinitionController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,17 @@
import org.apache.dolphinscheduler.api.audit.enums.AuditType;
import org.apache.dolphinscheduler.api.exceptions.ApiException;
import org.apache.dolphinscheduler.api.service.TaskDefinitionService;
import org.apache.dolphinscheduler.api.utils.PageInfo;
import org.apache.dolphinscheduler.api.utils.Result;
import org.apache.dolphinscheduler.api.utils.SensitivePropertyUtils;
import org.apache.dolphinscheduler.api.vo.TaskDefinitionVO;
import org.apache.dolphinscheduler.common.constants.Constants;
import org.apache.dolphinscheduler.common.enums.ReleaseState;
import org.apache.dolphinscheduler.dao.entity.TaskDefinitionLog;
import org.apache.dolphinscheduler.dao.entity.User;

import java.util.List;
import java.util.stream.Collectors;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
Expand Down Expand Up @@ -88,7 +92,17 @@ public Result queryTaskDefinitionVersions(@Parameter(hidden = true) @RequestAttr
@RequestParam(value = "pageNo") int pageNo,
@RequestParam(value = "pageSize") int pageSize) {
checkPageParams(pageNo, pageSize);
return taskDefinitionService.queryTaskDefinitionVersions(loginUser, projectCode, code, pageNo, pageSize);
Result result = taskDefinitionService.queryTaskDefinitionVersions(loginUser, projectCode, code, pageNo,
pageSize);
@SuppressWarnings("unchecked")

@SbloodyS SbloodyS Sep 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it's a good way to abuse @SuppressWarnings("unchecked"). We should try to avoid this problem in the official code.

PageInfo<TaskDefinitionLog> pageInfo = (PageInfo<TaskDefinitionLog>) result.getData();
if (pageInfo != null && pageInfo.getTotalList() != null) {
pageInfo.setTotalList(pageInfo.getTotalList().stream()
.map(SensitivePropertyUtils::mask)
.collect(Collectors.toList()));
}
result.setData(pageInfo);
return result;
}

/**
Expand Down Expand Up @@ -163,7 +177,7 @@ public Result<TaskDefinitionVO> queryTaskDefinitionDetail(@Parameter(hidden = tr
@PathVariable(value = "code") long code) {
TaskDefinitionVO taskDefinitionVO =
taskDefinitionService.queryTaskDefinitionDetail(loginUser, projectCode, code);
return Result.success(taskDefinitionVO);
return Result.success(SensitivePropertyUtils.mask(taskDefinitionVO));
}

/**
Expand Down
16 changes: 15 additions & 1 deletion ...-api/src/main/java/org/apache/dolphinscheduler/api/controller/TaskInstanceController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,13 +26,18 @@
import org.apache.dolphinscheduler.api.audit.enums.AuditType;
import org.apache.dolphinscheduler.api.exceptions.ApiException;
import org.apache.dolphinscheduler.api.service.TaskInstanceService;
import org.apache.dolphinscheduler.api.utils.PageInfo;
import org.apache.dolphinscheduler.api.utils.Result;
import org.apache.dolphinscheduler.api.utils.SensitivePropertyUtils;
import org.apache.dolphinscheduler.common.constants.Constants;
import org.apache.dolphinscheduler.common.enums.TaskExecuteType;
import org.apache.dolphinscheduler.dao.entity.TaskInstance;
import org.apache.dolphinscheduler.dao.entity.User;
import org.apache.dolphinscheduler.plugin.task.api.enums.TaskExecutionStatus;
import org.apache.dolphinscheduler.plugin.task.api.utils.ParameterUtils;

import java.util.stream.Collectors;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.GetMapping;
Expand Down Expand Up @@ -112,7 +117,7 @@ public Result queryTaskListPaging(@Parameter(hidden = true) @RequestAttribute(va
@RequestParam("pageSize") Integer pageSize) {
checkPageParams(pageNo, pageSize);
searchVal = ParameterUtils.handleEscapes(searchVal);
return taskInstanceService.queryTaskListPaging(
Result result = taskInstanceService.queryTaskListPaging(
loginUser,
projectCode,
workflowInstanceId,
Expand All @@ -129,6 +134,15 @@ public Result queryTaskListPaging(@Parameter(hidden = true) @RequestAttribute(va
taskExecuteType,
pageNo,
pageSize);
@SuppressWarnings("unchecked")
PageInfo<TaskInstance> pageInfo = (PageInfo<TaskInstance>) result.getData();
if (pageInfo != null && pageInfo.getTotalList() != null) {
pageInfo.setTotalList(pageInfo.getTotalList().stream()
.map(SensitivePropertyUtils::mask)
.collect(Collectors.toList()));
}
result.setData(pageInfo);
return result;
}

/**
Expand Down
82 changes: 68 additions & 14 deletions ...rc/main/java/org/apache/dolphinscheduler/api/controller/WorkflowDefinitionController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@
import org.apache.dolphinscheduler.api.service.WorkflowDefinitionService;
import org.apache.dolphinscheduler.api.utils.PageInfo;
import org.apache.dolphinscheduler.api.utils.Result;
import org.apache.dolphinscheduler.api.utils.SensitivePropertyUtils;
import org.apache.dolphinscheduler.common.constants.Constants;
import org.apache.dolphinscheduler.common.enums.ReleaseState;
import org.apache.dolphinscheduler.common.enums.WorkflowExecutionTypeEnum;
Expand All @@ -51,10 +52,14 @@
import org.apache.dolphinscheduler.dao.entity.TaskDefinition;
import org.apache.dolphinscheduler.dao.entity.User;
import org.apache.dolphinscheduler.dao.entity.WorkflowDefinition;
import org.apache.dolphinscheduler.dao.entity.WorkflowDefinitionLog;
import org.apache.dolphinscheduler.plugin.task.api.utils.ParameterUtils;
import org.apache.dolphinscheduler.plugin.task.api.utils.PropertySensitiveUtils;

import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.stream.Collectors;

import lombok.extern.slf4j.Slf4j;

Expand Down Expand Up @@ -128,7 +133,7 @@ public Result<WorkflowDefinition> createWorkflowDefinition(@Parameter(hidden = t
WorkflowDefinition workflowDefinition = workflowDefinitionService.createWorkflowDefinition(loginUser,
projectCode, name, description, globalParams,
locations, timeout, taskRelationJson, taskDefinitionJson, otherParamsJson, executionType);
return Result.success(workflowDefinition);
return Result.success(SensitivePropertyUtils.mask(workflowDefinition));
}

/**
Expand Down Expand Up @@ -254,7 +259,7 @@ public Result<WorkflowDefinition> updateWorkflowDefinition(@Parameter(hidden = t
if (releaseState == ReleaseState.ONLINE) {
workflowDefinitionService.onlineWorkflowDefinition(loginUser, projectCode, code);
}
return Result.success(workflowDefinition);
return Result.success(SensitivePropertyUtils.mask(workflowDefinition));
}

/**
Expand Down Expand Up @@ -283,8 +288,17 @@ public Result queryWorkflowDefinitionVersions(@Parameter(hidden = true) @Request
@PathVariable(value = "code") long code) {

checkPageParams(pageNo, pageSize);
return workflowDefinitionService.queryWorkflowDefinitionVersions(loginUser, projectCode, pageNo, pageSize,
code);
Result result = workflowDefinitionService.queryWorkflowDefinitionVersions(loginUser, projectCode, pageNo,
pageSize, code);
@SuppressWarnings("unchecked")
PageInfo<WorkflowDefinitionLog> pageInfo = (PageInfo<WorkflowDefinitionLog>) result.getData();
if (pageInfo != null && pageInfo.getTotalList() != null) {
pageInfo.setTotalList(pageInfo.getTotalList().stream()
.map(SensitivePropertyUtils::mask)
.collect(Collectors.toList()));
}
result.setData(pageInfo);
return result;
}

/**
Expand Down Expand Up @@ -386,7 +400,7 @@ public Result<DagData> queryWorkflowDefinitionByCode(@Parameter(hidden = true) @
@Parameter(name = "projectCode", description = "PROJECT_CODE", required = true) @PathVariable long projectCode,
@PathVariable(value = "code", required = true) long code) {
DagData dagData = workflowDefinitionService.queryWorkflowDefinitionByCode(loginUser, projectCode, code);
return Result.success(dagData);
return Result.success(SensitivePropertyUtils.mask(dagData));
}

/**
Expand All @@ -408,7 +422,7 @@ public Result<DagData> queryWorkflowDefinitionByName(@Parameter(hidden = true) @
@Parameter(name = "projectCode", description = "PROJECT_CODE", required = true) @PathVariable long projectCode,
@RequestParam("name") String name) {
DagData dagData = workflowDefinitionService.queryWorkflowDefinitionByName(loginUser, projectCode, name);
return Result.success(dagData);
return Result.success(SensitivePropertyUtils.mask(dagData));
}

/**
Expand All @@ -424,7 +438,13 @@ public Result<DagData> queryWorkflowDefinitionByName(@Parameter(hidden = true) @
@ApiException(QUERY_WORKFLOW_DEFINITION_LIST)
public Result<List<DagData>> queryWorkflowDefinitionList(@Parameter(hidden = true) @RequestAttribute(value = Constants.SESSION_USER) User loginUser,
@Parameter(name = "projectCode", description = "PROJECT_CODE", required = true) @PathVariable long projectCode) {
return Result.success(workflowDefinitionService.queryWorkflowDefinitionList(loginUser, projectCode));
List<DagData> dagDataList = workflowDefinitionService.queryWorkflowDefinitionList(loginUser, projectCode);
if (dagDataList == null) {
return Result.success(null);
}
return Result.success(dagDataList.stream()
.map(SensitivePropertyUtils::mask)
.collect(Collectors.toList()));
}

/**
Expand Down Expand Up @@ -480,6 +500,11 @@ public Result<PageInfo<WorkflowDefinition>> queryWorkflowDefinitionListPaging(

PageInfo<WorkflowDefinition> pageInfo = workflowDefinitionService.queryWorkflowDefinitionListPaging(
loginUser, projectCode, searchVal, otherParamsJson, userId, pageNo, pageSize);
if (pageInfo != null && pageInfo.getTotalList() != null) {
pageInfo.setTotalList(pageInfo.getTotalList().stream()
.map(SensitivePropertyUtils::mask)
.collect(Collectors.toList()));
}
return Result.success(pageInfo);

}
Expand Down Expand Up @@ -526,8 +551,14 @@ public Result<TreeViewDto> viewTree(@Parameter(hidden = true) @RequestAttribute(
public Result<List<TaskDefinition>> getNodeListByDefinitionCode(@Parameter(hidden = true) @RequestAttribute(value = Constants.SESSION_USER) User loginUser,
@Parameter(name = "projectCode", description = "PROJECT_CODE", required = true) @PathVariable long projectCode,
@PathVariable("code") long code) {
return Result.success(
workflowDefinitionService.getTaskNodeListByDefinitionCode(loginUser, projectCode, code));
List<TaskDefinition> taskDefinitions =
workflowDefinitionService.getTaskNodeListByDefinitionCode(loginUser, projectCode, code);
if (taskDefinitions == null) {
return Result.success(null);
}
return Result.success(taskDefinitions.stream()
.map(SensitivePropertyUtils::mask)
.collect(Collectors.toList()));
}

/**
Expand All @@ -548,8 +579,18 @@ public Result<List<TaskDefinition>> getNodeListByDefinitionCode(@Parameter(hidde
public Result<Map<Long, List<TaskDefinition>>> getNodeListMapByDefinitionCodes(@Parameter(hidden = true) @RequestAttribute(value = Constants.SESSION_USER) User loginUser,
@Parameter(name = "projectCode", description = "PROJECT_CODE", required = true) @PathVariable long projectCode,
@RequestParam("codes") String codes) {
return Result.success(
workflowDefinitionService.getNodeListMapByDefinitionCodes(loginUser, projectCode, codes));
Map<Long, List<TaskDefinition>> taskMap =
workflowDefinitionService.getNodeListMapByDefinitionCodes(loginUser, projectCode, codes);
if (taskMap == null) {
return Result.success(null);
}
Map<Long, List<TaskDefinition>> masked = new LinkedHashMap<>();
for (Map.Entry<Long, List<TaskDefinition>> entry : taskMap.entrySet()) {
List<TaskDefinition> tasks = entry.getValue();
masked.put(entry.getKey(), tasks == null ? null
: tasks.stream().map(SensitivePropertyUtils::mask).collect(Collectors.toList()));
}
return Result.success(masked);
}

/**
Expand Down Expand Up @@ -645,8 +686,14 @@ public Result<Void> batchDeleteWorkflowDefinitionByCodes(@Parameter(hidden = tru
@ApiException(QUERY_WORKFLOW_DEFINITION_LIST)
public Result<List<DagData>> queryAllWorkflowDefinitionByProjectCode(@Parameter(hidden = true) @RequestAttribute(value = Constants.SESSION_USER) User loginUser,
@Parameter(name = "projectCode", description = "PROJECT_CODE", required = true) @PathVariable long projectCode) {
return Result.success(
workflowDefinitionService.queryAllWorkflowDefinitionByProjectCode(loginUser, projectCode));
List<DagData> dagDataList =
workflowDefinitionService.queryAllWorkflowDefinitionByProjectCode(loginUser, projectCode);
if (dagDataList == null) {
return Result.success(null);
}
return Result.success(dagDataList.stream()
.map(SensitivePropertyUtils::mask)
.collect(Collectors.toList()));
}

/**
Expand All @@ -666,7 +713,14 @@ public Result<List<DagData>> queryAllWorkflowDefinitionByProjectCode(@Parameter(
public Result<WorkflowDefinitionVariablesDTO> viewVariables(@Parameter(hidden = true) @RequestAttribute(value = Constants.SESSION_USER) User loginUser,
@Parameter(name = "projectCode", description = "PROJECT_CODE", required = true) @PathVariable long projectCode,
@PathVariable("code") Long code) {
return Result.success(workflowDefinitionService.viewVariables(loginUser, projectCode, code));
WorkflowDefinitionVariablesDTO variables =
workflowDefinitionService.viewVariables(loginUser, projectCode, code);
if (variables == null) {
return Result.success(null);
}
return Result.success(new WorkflowDefinitionVariablesDTO(
PropertySensitiveUtils.maskSensitiveValues(variables.getGlobalParams()),
SensitivePropertyUtils.mask(variables.getLocalParams())));
}

}
25 changes: 21 additions & 4 deletions .../src/main/java/org/apache/dolphinscheduler/api/controller/WorkflowInstanceController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,20 +29,23 @@
import org.apache.dolphinscheduler.api.service.WorkflowInstanceService;
import org.apache.dolphinscheduler.api.utils.PageInfo;
import org.apache.dolphinscheduler.api.utils.Result;
import org.apache.dolphinscheduler.api.utils.SensitivePropertyUtils;
import org.apache.dolphinscheduler.api.vo.WorkflowInstanceSummaryVO;
import org.apache.dolphinscheduler.common.constants.Constants;
import org.apache.dolphinscheduler.common.enums.WorkflowExecutionStatus;
import org.apache.dolphinscheduler.dao.entity.User;
import org.apache.dolphinscheduler.dao.entity.WorkflowDefinition;
import org.apache.dolphinscheduler.dao.entity.WorkflowInstance;
import org.apache.dolphinscheduler.plugin.task.api.utils.ParameterUtils;
import org.apache.dolphinscheduler.plugin.task.api.utils.PropertySensitiveUtils;

import org.apache.commons.lang3.StringUtils;

import java.text.MessageFormat;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.stream.Collectors;

import lombok.extern.slf4j.Slf4j;

Expand Down Expand Up @@ -146,7 +149,15 @@ public Result<WorkflowInstanceTaskListDTO> queryTaskListByWorkflowInstanceId(@Pa
@PathVariable("id") Integer id) {
WorkflowInstanceTaskListDTO taskList =
workflowInstanceService.queryTaskListByWorkflowInstanceId(loginUser, projectCode, id);
return Result.success(taskList);
if (taskList == null) {
return Result.success(null);
}
return Result.success(new WorkflowInstanceTaskListDTO(
taskList.getWorkflowInstanceState(),
taskList.getTaskList() == null ? null
: taskList.getTaskList().stream()
.map(SensitivePropertyUtils::mask)
.collect(Collectors.toList())));
}

/**
Expand Down Expand Up @@ -189,7 +200,7 @@ public Result<WorkflowDefinition> updateWorkflowInstance(@Parameter(hidden = tru
@RequestParam(value = "timeout", required = false, defaultValue = "0") int timeout) {
WorkflowDefinition workflowDefinition = workflowInstanceService.updateWorkflowInstance(loginUser, projectCode,
id, taskRelationJson, taskDefinitionJson, scheduleTime, syncDefine, globalParams, locations, timeout);
return Result.success(workflowDefinition);
return Result.success(SensitivePropertyUtils.mask(workflowDefinition));
}

/**
Expand All @@ -212,7 +223,7 @@ public Result<WorkflowInstance> queryWorkflowInstanceById(@Parameter(hidden = tr
@PathVariable("id") Integer id) {
WorkflowInstance workflowInstance =
workflowInstanceService.queryWorkflowInstanceById(loginUser, projectCode, id);
return Result.success(workflowInstance);
return Result.success(SensitivePropertyUtils.mask(workflowInstance));
}

/**
Expand Down Expand Up @@ -333,7 +344,12 @@ public Result<WorkflowInstanceVariablesDTO> viewVariables(@Parameter(hidden = tr
@Parameter(name = "projectCode", description = "PROJECT_CODE", required = true) @PathVariable long projectCode,
@PathVariable("id") Integer id) {
WorkflowInstanceVariablesDTO variables = workflowInstanceService.viewVariables(loginUser, projectCode, id);
return Result.success(variables);
if (variables == null) {
return Result.success(null);
}
return Result.success(new WorkflowInstanceVariablesDTO(
PropertySensitiveUtils.maskSensitiveValues(variables.getGlobalParams()),
SensitivePropertyUtils.mask(variables.getLocalParams())));
}

/**
Expand Down Expand Up @@ -420,4 +436,5 @@ public Result<List<WorkflowInstanceSummaryVO>> queryWorkflowInstancesByTriggerCo
workflowInstanceService.queryByTriggerCode(loginUser, projectCode, triggerCode);
return Result.success(workflowInstances);
}

}
Loading
Loading