feat: 数据源口令传输改为固定 AES，禁止明文 password - #675
Merged
Merged
Conversation
Provide a dedicated aes_transport package that decrypts/encrypts with the compile-time SecretKey so DB service APIs can stop accepting plaintext passwords.
Reject plaintext password keys and accept fixed AES secret_password on connectivity check, create, and update request models, with unit coverage.
…plaintext Decrypt transport ciphertext into locals, clear request password fields before logging, and pass plaintext only into usecases for check/create/update.
PR Reviewer Guide 🔍
|
PR Code Suggestions ✨No code suggestions found in the successfully analyzed chunks. |
iwanghc
approved these changes
Sep 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
关联的 issue
https://github.com/actiontech/dms-ee/issues/994
描述你的变更
secret_password，请求里若带明文password则拒绝aes_transport，与前端同一把SecretKey），解密后的口令只留在内存，写日志前清掉请求中的口令字段password的调用会失败。不需要改文档确认项（pr提交后操作）
Tip
请在指定复审人之前，确认并完成以下事项，完成后✅
not_compatibleneed_update_doc