Backport #95325 to 25.3: Mask password in logs and system tables for the redis table function

robot-clickhouse · robot-clickhouse · commit 87ce53b45bc1 · 2026-01-29T19:22:45.000Z
diff --git a/src/Parsers/FunctionSecretArgumentsFinder.h b/src/Parsers/FunctionSecretArgumentsFinder.h
@@ -138,6 +138,10 @@ class FunctionSecretArgumentsFinder
         {
             findURLSecretArguments();
         }
+        else if (function->name() == "redis")
+        {
+            findRedisFunctionSecretArguments();
+        }
     }
 
     void findMySQLFunctionSecretArguments()
@@ -188,7 +192,7 @@ class FunctionSecretArgumentsFinder
         result.replacement = std::move(uri);
     }
 
-    void findRedisSecretArguments()
+    void findRedisTableEngineSecretArguments()
     {
         /// Redis does not have URL/address argument,
         /// only 'host:port' and separate "password" argument.
@@ -522,7 +526,7 @@ class FunctionSecretArgumentsFinder
         }
         else if (engine_name == "Redis")
         {
-            findRedisSecretArguments();
+            findRedisTableEngineSecretArguments();
         }
     }
 
@@ -612,6 +616,12 @@ class FunctionSecretArgumentsFinder
             markSecretArgument(url_arg_idx + 4);
     }
 
+    void findRedisFunctionSecretArguments()
+    {
+        // redis(host:port, key, structure, db_index, password, pool_size)
+        markSecretArgument(4);
+    }
+
     void findDatabaseEngineSecretArguments()
     {
         const String & engine_name = function->name();
diff --git a/tests/integration/test_mask_sensitive_info/test.py b/tests/integration/test_mask_sensitive_info/test.py
@@ -291,7 +291,7 @@ def test_create_table():
         ),
         f"Kafka() SETTINGS kafka_broker_list = '127.0.0.1', kafka_topic_list = 'topic', kafka_group_name = 'group', kafka_format = 'JSONEachRow', format_avro_schema_registry_url = 'http://schema_user:{password}@'",
         f"Kafka() SETTINGS kafka_broker_list = '127.0.0.1', kafka_topic_list = 'topic', kafka_group_name = 'group', kafka_format = 'JSONEachRow', format_avro_schema_registry_url = 'http://schema_user:{password}@domain.com'",
-
+        f"Redis('localhost', 0, '{password}') PRIMARY KEY x;",
     ]
 
     def make_test_case(i):
@@ -370,6 +370,7 @@ def make_test_case(i):
             f"CREATE TABLE table32 (`x` int) ENGINE = AzureBlobStorage('{masked_sas_conn_string}', 'exampledatasets', 'example.csv')",
             "CREATE TABLE table33 (`x` int) ENGINE = Kafka SETTINGS kafka_broker_list = '127.0.0.1', kafka_topic_list = 'topic', kafka_group_name = 'group', kafka_format = 'JSONEachRow', format_avro_schema_registry_url = 'http://schema_user:[HIDDEN]@'",
             "CREATE TABLE table34 (`x` int) ENGINE = Kafka SETTINGS kafka_broker_list = '127.0.0.1', kafka_topic_list = 'topic', kafka_group_name = 'group', kafka_format = 'JSONEachRow', format_avro_schema_registry_url = 'http://schema_user:[HIDDEN]@domain.com'",
+            "CREATE TABLE table35 (`x` int) ENGINE = Redis('localhost', 0, '[HIDDEN]') PRIMARY KEY x",
         ],
         must_not_contain=[password],
     )
@@ -487,6 +488,7 @@ def test_table_functions():
         f"gcs('http://minio1:9001/root/data/test11.csv.gz', 'minio', '{password}')",
         f"icebergS3('http://minio1:9001/root/data/test11.csv.gz', 'minio', '{password}')",
         f"icebergAzure('{azure_storage_account_url}', 'cont', 'test_simple_6.csv', '{azure_account_name}', '{azure_account_key}', 'CSV', 'none', 'auto')",
+        f"redis('localhost', 'key', 'key Int64', 0, '{password}')",
     ]
 
     def make_test_case(i):
@@ -570,6 +572,7 @@ def make_test_case(i):
             "CREATE TABLE tablefunc40 (`x` int) AS gcs('http://minio1:9001/root/data/test11.csv.gz', 'minio', '[HIDDEN]')",
             "CREATE TABLE tablefunc41 (`x` int) AS icebergS3('http://minio1:9001/root/data/test11.csv.gz', 'minio', '[HIDDEN]')",
             f"CREATE TABLE tablefunc42 (`x` int) AS icebergAzure('{azure_storage_account_url}', 'cont', 'test_simple_6.csv', '{azure_account_name}', '[HIDDEN]', 'CSV', 'none', 'auto')",
+            "CREATE TABLE tablefunc43 (`x` int) AS redis('localhost', 'key', 'key Int64', 0, '[HIDDEN]')",
         ],
         must_not_contain=[password],
     )

Original file line number	Diff line number	Diff line change
`@@ -138,6 +138,10 @@ class FunctionSecretArgumentsFinder`
`138`	`138`	`{`
`139`	`139`	`findURLSecretArguments();`
`140`	`140`	`}`
	`141`	`+ else if (function->name() == "redis")`
	`142`	`+ {`
	`143`	`+ findRedisFunctionSecretArguments();`
	`144`	`+ }`
`141`	`145`	`}`
`142`	`146`
`143`	`147`	`void findMySQLFunctionSecretArguments()`
`@@ -188,7 +192,7 @@ class FunctionSecretArgumentsFinder`
`188`	`192`	`result.replacement = std::move(uri);`
`189`	`193`	`}`
`190`	`194`
`191`		`- void findRedisSecretArguments()`
	`195`	`+ void findRedisTableEngineSecretArguments()`
`192`	`196`	`{`
`193`	`197`	`/// Redis does not have URL/address argument,`
`194`	`198`	`/// only 'host:port' and separate "password" argument.`
`@@ -522,7 +526,7 @@ class FunctionSecretArgumentsFinder`
`522`	`526`	`}`
`523`	`527`	`else if (engine_name == "Redis")`
`524`	`528`	`{`
`525`		`- findRedisSecretArguments();`
	`529`	`+ findRedisTableEngineSecretArguments();`
`526`	`530`	`}`
`527`	`531`	`}`
`528`	`532`
`@@ -612,6 +616,12 @@ class FunctionSecretArgumentsFinder`
`612`	`616`	`markSecretArgument(url_arg_idx + 4);`
`613`	`617`	`}`
`614`	`618`
	`619`	`+ void findRedisFunctionSecretArguments()`
	`620`	`+ {`
	`621`	`+ // redis(host:port, key, structure, db_index, password, pool_size)`
	`622`	`+ markSecretArgument(4);`
	`623`	`+ }`
	`624`	`+`
`615`	`625`	`void findDatabaseEngineSecretArguments()`
`616`	`626`	`{`
`617`	`627`	`const String & engine_name = function->name();`