ClickHouse / ClickHouse/dbt-clickhouse
Credentials can be viewed by anyone with macro
- Dominant language
- Python
- Stars
- 362
- Forks
- 177
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 8
Description
**Is your feature request related to a problem? Please describe.**
I poked around and found out that credentials can be easily viewed with macro
```sql
{{ adapter.get_credentials({}) }}
```
This method appeared in commit https://github.com/ClickHouse/dbt-clickhouse/commit/24af7d94d4a3bd46686490838257aaab134ac2b1
It is used for dictionary materialization, and.. it makes impossible to work on project with team securely, cause anyone can paste production account somewhere.
**Describe the solution you'd like**
It should not exist
Contributor guide
Research direction
Start by inspecting commit 24af7d94d4a3bd46686490838257aaab134ac2b1 and searching the repository for adapter.get_credentials and dictionary materialization. Confirm where credentials become available to macros, then define a regression check showing that macros cannot view them while dictionary materialization continues to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- clickhouse, python
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100