Trait mz_sql::ast::display::WithOptionName
source · pub trait WithOptionName {
// Provided method
fn redact_value(&self) -> bool { ... }
}Expand description
Functions that generalize to AST nodes representing the “name” of a WITH
option.
Provided Methods§
sourcefn redact_value(&self) -> bool
fn redact_value(&self) -> bool
Expresses whether or not values should be redacted based on the option name (i.e. the option’s “key”).
§WARNING
Whenever implementing this trait consider very carefully whether or not this value could contain sensitive user data.
§Context
Many statements in MZ use the format WITH (<options>...) to modify the
resulting behavior of the statement. Most often these are modeled in the
AST as a struct with two fields: an option name and a value.
We do not type check the values of the types until planning, so most
values represent arbitrary user input. To prevent leaking any PII in
that data, we default to replacing values with the string <REDACTED>.
However, in some cases, the values do not need to be redacted. For our
WITH options, knowing which option we’re dealing with should be
sufficient to understand if a value needs redaction––so this trait
controls redaction on a per-option basis.
§Genericizing WITH options
It would be nice to force every AST node we consider a WITH option to
conform to a particular structure––however, we have a proc macro that
generates visitors over all of our nodes that inhibits our ability to do
this easily. This means, unfortunately, that we cannot rely on
compilation guarantees for this and instead must use the honor system.
§Nothing is ever redacted…
In the initial implementation of this trait, no option requires its values to be redacted (except for the one test case). That doesn’t mean there won’t be in the future. When in doubt, take the more conservative approach.