Skip to content

Fix applying query masking rules to ddl statements.#89272

Merged
evillique merged 4 commits intoClickHouse:masterfrom
MikhailBurdukov:fix_query_masking_rules_with_ddl
Nov 15, 2025
Merged

Fix applying query masking rules to ddl statements.#89272
evillique merged 4 commits intoClickHouse:masterfrom
MikhailBurdukov:fix_query_masking_rules_with_ddl

Conversation

@MikhailBurdukov
Copy link
Copy Markdown
Contributor

@MikhailBurdukov MikhailBurdukov commented Oct 31, 2025

Changelog category (leave one):

  • Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

Prevent query masking rules from being incorrectly applied to DDL statements.

Documentation entry for user-facing changes

  • Documentation is written (mandatory for new features)

Details

If query masking rules are specified, then it will be applied to DDL queries and replaced valid statement with masking. Such behaviour causes that the node in zk with DDL task will have already formatted query.

Repro:
config:

 
        
              hide s3 secret key in named collection
              sensetive
              replaced
        
  
  1
CREATE TABLE test_table ON CLUSTER 'test_shard_localhost' (s String, sensetive UInt32) ENGINE = MergeTree ORDER BY s

SELECT create_table_query
FROM system.tables
WHERE `table` = 'test_table'
SETTINGS format_display_secrets_in_show_and_select = 1

Query id: f41917ec-dd63-4900-99f3-c5c353045e02

   ┌─create_table_query──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
1. │ CREATE TABLE default.test_table (`s` String, `replaced` UInt32) ENGINE = MergeTree ORDER BY s SETTINGS index_granularity = 8192 │
   └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

@evillique evillique self-assigned this Nov 3, 2025
@evillique evillique added the can be tested Allows running workflows for external contributors label Nov 3, 2025
@clickhouse-gh
Copy link
Copy Markdown
Contributor

clickhouse-gh bot commented Nov 3, 2025

Workflow [PR], commit [47be48f]

Summary:

job_name test_name status info comment
Stateless tests (amd_tsan, parallel, 2/2) failure
03212_variant_dynamic_cast_or_default FAIL cidb, flaky
Integration tests (amd_tsan, 3/6) failure
test_ytsaurus/test_tables.py::test_yt_simple_table_engine FAIL cidb
test_ytsaurus/test_tables.py::test_yt_simple_table_function FAIL cidb
test_ytsaurus/test_tables.py::test_ytsaurus_primitive_types[uint8] FAIL cidb
test_ytsaurus/test_tables.py::test_ytsaurus_primitive_types[uint16] FAIL cidb
test_ytsaurus/test_tables.py::test_ytsaurus_primitive_types[uint32] FAIL cidb
test_ytsaurus/test_tables.py::test_ytsaurus_primitive_types[uint64] FAIL cidb
test_ytsaurus/test_tables.py::test_ytsaurus_primitive_types[int8] FAIL cidb
test_ytsaurus/test_tables.py::test_ytsaurus_primitive_types[int16] FAIL cidb
test_ytsaurus/test_tables.py::test_ytsaurus_primitive_types[int32] FAIL cidb
test_ytsaurus/test_tables.py::test_ytsaurus_primitive_types[int64] FAIL cidb
32 more test cases not shown
Upgrade check (amd_asan) failure
Killed by signal (in clickhouse-server.log) FAIL cidb
Fatal message in clickhouse-server.log (see fatal_messages.txt) FAIL cidb
Killed by signal (output files) FAIL cidb
Found signal in gdb.log FAIL cidb

@clickhouse-gh clickhouse-gh bot added the pr-ci label Nov 3, 2025
@evillique
Copy link
Copy Markdown
Member

Style check — Failures: 1/11

tests/queries/0_stateless/03703_query_masking_with_ddl.reference
These files should not be executable.

Could you please fix it?

@clickhouse-gh clickhouse-gh bot added pr-bugfix Pull request with bugfix, not backported by default and removed pr-ci labels Nov 3, 2025
@evillique evillique added this pull request to the merge queue Nov 15, 2025
Merged via the queue into ClickHouse:master with commit e7413fd Nov 15, 2025
127 of 131 checks passed
@robot-ch-test-poll3 robot-ch-test-poll3 added the pr-synced-to-cloud The PR is synced to the cloud repo label Nov 15, 2025
@evillique evillique added the pr-must-backport Pull request should be backported intentionally. Use this label with great care! label Nov 15, 2025
robot-ch-test-poll2 added a commit that referenced this pull request Nov 15, 2025
Cherry pick #89272 to 25.10: Fix applying query masking rules to ddl statements.
@robot-ch-test-poll4 robot-ch-test-poll4 added the pr-must-backport-synced The `*-must-backport` labels are synced into the cloud Sync PR label Nov 15, 2025
clickhouse-gh bot added a commit that referenced this pull request Nov 16, 2025
Backport #89272 to 25.10: Fix applying query masking rules to ddl statements.
robot-clickhouse added a commit that referenced this pull request Nov 16, 2025
Cherry pick #89272 to 25.3: Fix applying query masking rules to ddl statements.
robot-clickhouse added a commit that referenced this pull request Nov 16, 2025
Cherry pick #89272 to 25.8: Fix applying query masking rules to ddl statements.
robot-clickhouse added a commit that referenced this pull request Nov 16, 2025
Cherry pick #89272 to 25.9: Fix applying query masking rules to ddl statements.
@robot-ch-test-poll4 robot-ch-test-poll4 added the pr-backports-created Backport PRs are successfully created, it won't be processed by CI script anymore label Nov 16, 2025
evillique added a commit that referenced this pull request Nov 16, 2025
Backport #89272 to 25.9: Fix applying query masking rules to ddl statements.
evillique added a commit that referenced this pull request Nov 25, 2025
Backport #89272 to 25.3: Fix applying query masking rules to ddl statements.
evillique added a commit that referenced this pull request Nov 25, 2025
Backport #89272 to 25.8: Fix applying query masking rules to ddl statements.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

can be tested Allows running workflows for external contributors pr-backports-created Backport PRs are successfully created, it won't be processed by CI script anymore pr-bugfix Pull request with bugfix, not backported by default pr-must-backport Pull request should be backported intentionally. Use this label with great care! pr-must-backport-synced The `*-must-backport` labels are synced into the cloud Sync PR pr-synced-to-cloud The PR is synced to the cloud repo

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants