Repository: ClickHouse/ClickHouse
File: src/Parsers/FunctionSecretArgumentsFinder.h (C/C++)

Code before:
            static re2::RE2 sas_signature_pattern = "SharedAccessSignature=.*?(;|$)";
            if (RE2::Replace(&url_arg, sas_signature_pattern, "SharedAccessSignature=[HIDDEN]\\1"))
            {
                chassert(result.count == 0); /// We shouldn't use replacement with masking other arguments
                result.start = url_arg_idx;
                result.are_named = argument_is_named;
                result.count = 1;
                result.replacement = url_arg;
                return true;
            }
        }

        return false;
    }

    void findURLSecretArguments()
    {
        if (isNamedCollectionName(0))
            return;

        excludeS3OrURLNestedMaps();
        
        String uri;
        if (tryGetStringFromArgument(0, &uri))
        {
            maskURIPassword(&uri);
            chassert(result.count == 0); /// We shouldn't use replacement with masking other arguments
            result.start = 0;
            result.count = 1;
            result.replacement = std::move(uri);
        }
    }

    bool tryGetStringFromArgument(size_t arg_idx, String * res, bool allow_identifier = true) const
    {
        if (arg_idx >= function->arguments->size())
            return false;

        return tryGetStringFromArgument(*function->arguments->at(arg_idx), res, allow_identifier);
    }

    static bool tryGetStringFromArgument(const AbstractFunction::Argument & argument, String * res, bool allow_identifier = true)
    {
        return argument.tryGetString(res, allow_identifier);
    }

    void findRemoteFunctionSecretArguments()
    {
        if (isNamedCollectionName(0))
        {
            /// remote(named_collection, ..., password = 'password', ...)

Review comment (suggestion):
This change makes passwords in URLs to be correctly replaced with `[HIDDEN]` everywhere and not just in `system.query_log`.

Code after:
            static re2::RE2 sas_signature_pattern = "SharedAccessSignature=.*?(;|$)";
            if (RE2::Replace(&url_arg, sas_signature_pattern, "SharedAccessSignature=[HIDDEN]\\1"))
            {
                chassert(result.count == 0); /// We shouldn't use replacement with masking other arguments
                result.start = url_arg_idx;
                result.are_named = argument_is_named;
                result.count = 1;
                result.replacement = url_arg;
                return true;
            }
        }

        return false;
    }

    void findURLSecretArguments()
    {
        if (isNamedCollectionName(0))
            return;

        excludeS3OrURLNestedMaps();

        String uri;
        if (tryGetStringFromArgument(0, &uri) && maskURIPassword(&uri))
        {
            chassert(result.count == 0); /// We shouldn't use replacement with masking other arguments
            result.start = 0;
            result.count = 1;
            result.replacement = std::move(uri);
        }
    }

    bool tryGetStringFromArgument(size_t arg_idx, String * res, bool allow_identifier = true) const
    {
        if (arg_idx >= function->arguments->size())
            return false;

        return tryGetStringFromArgument(*function->arguments->at(arg_idx), res, allow_identifier);
    }

    static bool tryGetStringFromArgument(const AbstractFunction::Argument & argument, String * res, bool allow_identifier = true)
    {
        return argument.tryGetString(res, allow_identifier);
    }

    void findRemoteFunctionSecretArguments()
    {
        if (isNamedCollectionName(0))
        {
            /// remote(named_collection, ..., password = 'password', ...)
            findSecretNamedArgument("password", 1);