fix(masking): fixes multi-level nested fields, and hides non-JSON entries #2004
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi! Follow up to previous PR as I realised there were a few small issues after deploying to another environment:
Returning the original values if it isn't JSON-formattable is actually dangerous, as it means if the schema registry is down or if the wrong schema registry is selected in AKHQ in a multi-schema-registry-setup, the binary format data will still show as a String which in most cases still displays some of the sensitive data. To be safe, this means
json_mask_by_default
will now ONLY show structured data and anything else will display a placeholder message. This prevents any unwanted data leakage.Fixes multi-level nested objects for the 'mask by default' option. Before we weren't prepending
currentKey
. So for example given a request to exposeone.two.three
,one.two.three
would still be masked - the filter would have needed to specify justtwo.three
(which is incorrect and would also meananother.two.three
would also be unmasked). This fixes it to work as expected, soone.two.three
unmasksone.two.three
and also isn't applied toanother.two.three