You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Mask operator accepts an empty masking_char and deletes the masked characters #2486
Describe the bug
The mask operator accepts an empty masking_char. Validation only rejects values longer than one character, so "" passes. operate then builds "" * chars_to_mask + text[chars_to_mask:], so the masked characters are deleted, not masked. The output is shorter than the input and keeps the unmasked part of the value.
Expected behavior InvalidParamError, like for a masking_char of two characters ("masking_char must be a character").
Actual behavior
No error. The first 12 digits are removed and the result is 'My card 1111 ok'.
Additional context
The check is len(masking_char) > 1; len(masking_char) != 1 would cover the empty string too. The same request through the anonymizer REST API ("masking_char": "") behaves the same way.
I have a fix with a regression test and will open a PR.
Activity