programmatically remove encrypted attributes. Added relevant spec.

lib/gitlab/import_export/relation_factory.rb

@@ -63,6 +63,7 @@ module Gitlab
 
         handle_group_label if group_label?
         reset_tokens!
+        remove_encrypted_attributes!
 
         @relation_hash['data'].deep_symbolize_keys! if @relation_name == :events && @relation_hash['data']
         set_st_diffs if @relation_name == :merge_request_diff
@@ -152,6 +153,14 @@ module Gitlab
         end
       end
 
+      def remove_encrypted_attributes!
+        return if relation_class.encrypted_attributes.empty?
+
+        relation_class.encrypted_attributes.each_key do |key|
+          @relation_hash[key.to_s] = nil
+        end
+      end
+
       def relation_class
         @relation_class ||= @relation_name.to_s.classify.constantize
       end

spec/features/projects/import_export/export_file_spec.rb

@@ -74,8 +74,8 @@ feature 'Import/Export - project export integration test', feature: true, js: tr
         Otherwise, please add the exception to +safe_list+ in CURRENT_SPEC using #{sensitive_word} as the key and the
         correspondent hash or model as the value.
 
-        Also, if the attribute is encrypted, please add it to either the list of excluded attributes in IMPORT_EXPORT_CONFIG
-        or the model to RelationFactory::TOKEN_RESET_MODELS if it includes a token that can be reset.
+        Also, if the attribute is a generated unique token, please add it to RelationFactory::TOKEN_RESET_MODELS if it needs to be
+        reset (to prevent duplicate column problems while importing to the same instance).
 
         IMPORT_EXPORT_CONFIG: #{Gitlab::ImportExport.config_file}
         CURRENT_SPEC: #{__FILE__}

spec/lib/gitlab/import_export/relation_factory_spec.rb

@@ -178,4 +178,15 @@ describe Gitlab::ImportExport::RelationFactory, lib: true do
       expect(created_object.author).to eq(new_user)
     end
   end
+
+  context 'encrypted attributes' do
+    let(:relation_sym) { 'Ci::Variable' }
+    let(:relation_hash) do
+      create(:ci_variable).as_json
+    end
+
+    it 'maps the right author to the imported note' do
+      expect(created_object.value).to be_nil
+    end
+  end
 end