Details
-
Task
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
2.1.2
-
None
-
2017-37, 2017-38
Description
Using the masking filter certain columns can be masked. However, as the maxrows filter works on the resultset alone, it is possible to easily circumvent it. For instance,
mysql> SELECT id, firstname, lastname FROM masking;
|
+----+-----------+----------+
|
| id | firstname | lastname |
|
+----+-----------+----------+
|
| 1 | test1 | XXXXX |
|
| 2 | test2 | XXXXX |
|
+----+-----------+----------+
|
|
mysql> SELECT id, firstname, CONCAT(lastname) FROM masking;
|
+----+-----------+------------------+
|
| id | firstname | CONCAT(lastname) |
|
+----+-----------+------------------+
|
| 1 | test1 | mask1 |
|
| 2 | test2 | mask2 |
|
+----+-----------+------------------+
|
That can be prevented using the firewall. However, currently it is quite inconvenient as you would need to separately list all functions using which the masking can be circumvented.
There should be an easy way to use maxrows and the firewall filter together, for securely masking certain columns.