Harden configuration reading

src/databricks/labs/ucx/assessment/secrets.py

@@ -30,13 +30,20 @@ def _get_secret_if_exists(self, secret_scope, secret_key) -> str | None:
             )
             return None
 
-    def _get_value_from_config_key(self, config: dict, key: str, get_secret: bool = True) -> str | None:
+    def _get_value_from_config_key(
+        self,
+        config: dict,
+        key: str,
+        get_secret: bool = True,
+    ) -> str | None:
         """Get a config value based on its key, with some special handling:
         If the key is prefixed with spark_conf, i.e. this is in a cluster policy, the actual value is nested
         If the value is of format {{secret_scope/secret}}, we extract that as well
         """
         if re.search("spark_conf", key):
-            value = config.get(key, {}).get("value", "")
+            value = config.get(key, {})
+            if isinstance(value, dict):
+                value = value.get("value", "")
         else:
             value = config.get(key, "")
         # retrieve from secret scope if used

tests/unit/assessment/test_secrets.py

@@ -0,0 +1,23 @@
+import pytest
+
+from databricks.labs.ucx.assessment.secrets import SecretsMixin
+
+
+@pytest.mark.parametrize(
+    "key,expected",
+    [
+        ("spark_conf.spark.hadoop.javax.jdo.option.ConnectionURL", "url"),
+        ("NonExistentKey", ""),
+        ("spark_conf.invalid", "{'should_not': 'be_string'}"),
+    ],
+)
+def test_secrets_mixin_gets_value_from_config_key(key, expected) -> None:
+    config = {
+        "spark_conf.invalid": "{'should_not': 'be_string'}",
+        "spark_conf.spark.hadoop.javax.jdo.option.ConnectionURL": {"value": "url"},
+    }
+    secrets_mixin = SecretsMixin()
+
+    value = secrets_mixin._get_value_from_config_key(config, key)  # pylint: disable=protected-access
+
+    assert value == expected