[MXS-1733] Data masking does not work with UNION queries Created: 2018-03-21  Updated: 2018-03-26  Resolved: 2018-03-26

Status: Closed
Project: MariaDB MaxScale
Component/s: Filter, masking
Affects Version/s: 2.2.3
Fix Version/s: 2.2.4

Type: Bug Priority: Major
Reporter: Alexandr Hacicheant Assignee: Johan Wikman
Resolution: Fixed Votes: 0
Labels: None


 Description   

I'm not sure if it's a bug, but I have a problem with data masking filter when query contains UNION.

CREATE TABLE `users` ( `id` INT NOT NULL AUTO_INCREMENT , `name` VARCHAR(255) NOT NULL , `email` VARCHAR(255) NOT NULL , PRIMARY KEY (`id`)) ENGINE = InnoDB;
INSERT INTO `users` (`name`,`email`) VALUES ('John', 'john@example.com'),('Max', 'max@example.com'),('Peter', 'peter@example.com');
 
mysql> select * from users;
+----+-------+-------------------+
| id | name  | email             |
+----+-------+-------------------+
|  1 | John  | ****************  |
|  2 | Max   | ***************   |
|  3 | Peter | ***************** |
+----+-------+-------------------+
3 rows in set (0.00 sec)

The UNION issue:

mysql> select * from users where id = 1 union select * from users where id = 2;
+----+------+------------------+
| id | name | email            |
+----+------+------------------+
|  1 | John | john@example.com |
|  2 | Max  | max@example.com  |
+----+------+------------------+
2 rows in set (0.00 sec)

Config:

[Column-Masking]
type=filter
module=masking
warn_type_mismatch=always
large_payload=abort
rules=/etc/maxscale.d/masking_rules.json

masking_rules.json contains:

{
   "rules": [
       {
           "replace": {
               "table": "users",
               "column": "email"
           },
           "with": {
               "fill": "*"
           }
       }
   ]
}

If remove table definition "table": "users" it works fine



 Comments   
Comment by Johan Wikman [ 2018-03-21 ]

disc Please add your masking rules.

Comment by Alexandr Hacicheant [ 2018-03-21 ]

Updated issue with config details

Comment by Johan Wikman [ 2018-03-21 ]

Ok, managed to repeat the problem. It seems that in the case of such a UNION, the resultset will not contain information about what table or database a particular column comes from. Consequently, since a table has been specified in the rules, there will not be a match and no masking will be performed.

I think I will change it so that in such a case (i.e. there is no information about table or database), a specified table in the rules will be ignored and the data will be masked if the column matches. Given that this is for privacy purposes it is better to err on the more cautious side.

Comment by Johan Wikman [ 2018-03-22 ]

disc I've changed it now so that if a rule specifies a table but the resultset does not contain the table name, then if the column name matches, the whole rule is considered a match. The effect is that the email address in the of your second SELECT will be masked.

However, it will also mean that if you have another table, say public_users that also has a field called email but that you have not setup masking for, then the results will nevertheless be masked if you use such a UNION when selecting data from that table.

Comment by Alexandr Hacicheant [ 2018-03-22 ]

@johan.wikman Anyway, it's better than don't mask emails for UNIONs, I guess.
Same question about INTERSECT, EXCEPT from MariaDB 10.3. Will be there the same behavior as for UNION?

Comment by Johan Wikman [ 2018-03-22 ]

disc I can't verify that at the moment but I would expect the behaviour to be the same. Indeed I would be surprised if it were not.

Generated at Thu Feb 08 04:09:00 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.