ClickHouse / ClickHouse/dbt-clickhouse

Credentials can be viewed by anyone with macro

Open
#674 0 comments 7 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
362
Forks
177
Avg merge
2d 10h
Merged PRs (30d)
8

Description

**Is your feature request related to a problem? Please describe.**
I poked around and found out that credentials can be easily viewed with macro

```sql
{{ adapter.get_credentials({}) }}
```
This method appeared in commit https://github.com/ClickHouse/dbt-clickhouse/commit/24af7d94d4a3bd46686490838257aaab134ac2b1
It is used for dictionary materialization, and.. it makes impossible to work on project with team securely, cause anyone can paste production account somewhere.

**Describe the solution you'd like**
It should not exist

Contributor guide

Open the contributing guide

Research direction

Start by inspecting commit 24af7d94d4a3bd46686490838257aaab134ac2b1 and searching the repository for adapter.get_credentials and dictionary materialization. Confirm where credentials become available to macros, then define a regression check showing that macros cannot view them while dictionary materialization continues to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
clickhouse, python
Domain
databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.