Skip to content

fix(bqjdbc): add default OAuth client id/secret #12946

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
logachev wants to merge 1 commit into
base: main
Choose a base branch
from
+24 −2
Open

fix(bqjdbc): add default OAuth client id/secret #12946

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ...ud-bigquery-jdbc/src/main/java/com/google/cloud/bigquery/jdbc/BigQueryJdbcUrlUtility.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,8 @@ protected boolean removeEldestEntry(Map.Entry<String, Map<String, String>> eldes
static final String OAUTH_REFRESH_TOKEN_PROPERTY_NAME = "OAuthRefreshToken";
static final String OAUTH_CLIENT_ID_PROPERTY_NAME = "OAuthClientId";
static final String OAUTH_CLIENT_SECRET_PROPERTY_NAME = "OAuthClientSecret";
static final String DEFAULT_OAUTH_CLIENT_ID = "977385342095.apps.googleusercontent.com";
static final String DEFAULT_OAUTH_CLIENT_SECRET = "wbER7576mc_1YOII0dGk7jEE";
Comment thread
logachev marked this conversation as resolved.
static final String ENABLE_HTAPI_PROPERTY_NAME = "EnableHighThroughputAPI";
static final String PROXY_HOST_PROPERTY_NAME = "ProxyHost";
static final String PROXY_PORT_PROPERTY_NAME = "ProxyPort";
Expand Down
8 changes: 6 additions & 2 deletions ...y/google-cloud-bigquery-jdbc/src/main/java/com/google/cloud/bigquery/jdbc/DataSource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -940,15 +940,19 @@ public void setDestinationDatasetExpirationTime(long destinationDatasetExpiratio
}

public String getOAuthClientId() {
return oAuthClientId;
return oAuthClientId != null && !oAuthClientId.isEmpty()
? oAuthClientId
: BigQueryJdbcUrlUtility.DEFAULT_OAUTH_CLIENT_ID;
Comment on lines +943 to +945
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot Apr 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The getter returns a default OAuth client ID unconditionally when the field is null or empty. This can lead to authentication conflicts when using other authentication types (e.g., Service Account) that do not require a client ID. Consider applying this default only when the OAuthType is set to User Account. Also, using trim().isEmpty() ensures that blank strings are correctly handled as empty.

Suggested change
return oAuthClientId != null && !oAuthClientId.isEmpty()
? oAuthClientId
: BigQueryJdbcUrlUtility.DEFAULT_OAUTH_CLIENT_ID;
return oAuthClientId != null && !oAuthClientId.trim().isEmpty()
? oAuthClientId
: BigQueryJdbcUrlUtility.DEFAULT_OAUTH_CLIENT_ID;

Copy link
Copy Markdown
Contributor

@keshavdandeva keshavdandeva Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we not want to add trim().isEmpty()?

}

public void setOAuthClientId(String oAuthClientId) {
this.oAuthClientId = oAuthClientId;
}

public String getOAuthClientSecret() {
return oAuthClientSecret;
return oAuthClientSecret != null && !oAuthClientSecret.isEmpty()
? oAuthClientSecret
: BigQueryJdbcUrlUtility.DEFAULT_OAUTH_CLIENT_SECRET;
Comment on lines +953 to +955
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot Apr 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Similar to getOAuthClientId, this getter returns a default secret unconditionally. This may cause issues with other authentication methods. Ensure that this default is only applied when appropriate for the selected OAuthType. Using trim().isEmpty() is also recommended here.

Suggested change
return oAuthClientSecret != null && !oAuthClientSecret.isEmpty()
? oAuthClientSecret
: BigQueryJdbcUrlUtility.DEFAULT_OAUTH_CLIENT_SECRET;
return oAuthClientSecret != null && !oAuthClientSecret.trim().isEmpty()
? oAuthClientSecret
: BigQueryJdbcUrlUtility.DEFAULT_OAUTH_CLIENT_SECRET;

Copy link
Copy Markdown
Contributor

@keshavdandeva keshavdandeva Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same question here

}

public void setOAuthClientSecret(String oAuthClientSecret) {
Expand Down
16 changes: 16 additions & 0 deletions ...query-jdbc/src/test/java/com/google/cloud/bigquery/jdbc/BigQueryJdbcOAuthUtilityTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -218,6 +218,22 @@ public void testParseOAuthPropsForUserAuth() {
assertThat(authProperties.get("OAuthClientSecret")).isEqualTo("secret");
}

@Test
public void testParseOAuthPropsForUserAuthDefault() {
Map<String, String> authProperties =
BigQueryJdbcOAuthUtility.parseOAuthProperties(
DataSource.fromUrl(
"jdbc:bigquery://https://www.googleapis.com/bigquery/v2:443;"
+ "OAuthType=1;ProjectId=MyBigQueryProject;"),
null);

assertThat(authProperties.get("OAuthType")).isEqualTo("GOOGLE_USER_ACCOUNT");
assertThat(authProperties.get("OAuthClientId"))
.isEqualTo(BigQueryJdbcUrlUtility.DEFAULT_OAUTH_CLIENT_ID);
assertThat(authProperties.get("OAuthClientSecret"))
.isEqualTo(BigQueryJdbcUrlUtility.DEFAULT_OAUTH_CLIENT_SECRET);
}

@Test
public void testGenerateUserAuthURL() {
try {
Expand Down
Loading