[MXS-1733] Data masking does not work with UNION queries Created: 2018-03-21 Updated: 2018-03-26 Resolved: 2018-03-26 |
|
| Status: | Closed |
| Project: | MariaDB MaxScale |
| Component/s: | Filter, masking |
| Affects Version/s: | 2.2.3 |
| Fix Version/s: | 2.2.4 |
| Type: | Bug | Priority: | Major |
| Reporter: | Alexandr Hacicheant | Assignee: | Johan Wikman |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Description |
|
I'm not sure if it's a bug, but I have a problem with data masking filter when query contains UNION.
The UNION issue:
Config:
masking_rules.json contains:
If remove table definition "table": "users" it works fine |
| Comments |
| Comment by Johan Wikman [ 2018-03-21 ] |
|
disc Please add your masking rules. |
| Comment by Alexandr Hacicheant [ 2018-03-21 ] |
|
Updated issue with config details |
| Comment by Johan Wikman [ 2018-03-21 ] |
|
Ok, managed to repeat the problem. It seems that in the case of such a UNION, the resultset will not contain information about what table or database a particular column comes from. Consequently, since a table has been specified in the rules, there will not be a match and no masking will be performed. I think I will change it so that in such a case (i.e. there is no information about table or database), a specified table in the rules will be ignored and the data will be masked if the column matches. Given that this is for privacy purposes it is better to err on the more cautious side. |
| Comment by Johan Wikman [ 2018-03-22 ] |
|
disc I've changed it now so that if a rule specifies a table but the resultset does not contain the table name, then if the column name matches, the whole rule is considered a match. The effect is that the email address in the of your second SELECT will be masked. However, it will also mean that if you have another table, say public_users that also has a field called email but that you have not setup masking for, then the results will nevertheless be masked if you use such a UNION when selecting data from that table. |
| Comment by Alexandr Hacicheant [ 2018-03-22 ] |
|
@johan.wikman Anyway, it's better than don't mask emails for UNIONs, I guess. |
| Comment by Johan Wikman [ 2018-03-22 ] |
|
disc I can't verify that at the moment but I would expect the behaviour to be the same. Indeed I would be surprised if it were not. |