oscerd opened a new issue, #1797:
URL: https://github.com/apache/camel-kafka-connector/issues/1797
## Description
For component-style connectors (`camel.sink.component` /
`camel.source.component` plus
`camel.sink.endpoint.*` / `camel.source.endpoint.*`),
`CamelSinkTask.start()` and
`CamelSourceTask.start()` compose a single endpoint URI from the endpoint
and path options via
`TaskHelper.buildUrl()` and store the result under a synthesized property
key:
- `camel.kamelet.ckcSink.toUrl` (`CamelSinkTask.java:129`)
- `camel.kamelet.ckcSource.fromUrl` (`CamelSourceTask.java:153`)
`CamelKafkaConnectMain.Builder.build()` then logs every initial property at
INFO:
```java
List<String> filteredProps =
camelProperties.entrySet().stream().map(this::filterSensitive).collect(Collectors.toList());
LOG.info("Setting initial properties in Camel context: [{}]", filteredProps);
```
`filterSensitive()` (`CamelKafkaConnectMain.java:221-227`) decides what to
mask from the **key name
only**:
```java
private String filterSensitive(Map.Entry<Object, Object> entry) {
if (SensitiveUtils.containsSensitive((String) entry.getKey())) {
return entry.getKey() + "=xxxxxxx";
}
return entry.getKey() + "=" + entry.getValue();
}
```
`camel.kamelet.ckcSink.toUrl` and `camel.kamelet.ckcSource.fromUrl` contain
no token that
`SensitiveUtils` recognises, so the composed URI is printed verbatim —
including the values of
options that are correctly declared `ConfigDef.Type.PASSWORD` in the
generated connector config and
that are dutifully masked under their own keys on the very same log line.
The same applies to an operator-supplied `camel.sink.url` /
`camel.source.url` that carries userinfo
or credential query parameters.
## Expected Behavior
No option value that the connector config declares as
`ConfigDef.Type.PASSWORD`, and no value that
`SensitiveUtils` would mask under its own key, appears in clear text in the
connector's own logging
at default levels — regardless of which property key it is logged under.
## Actual Behavior
The masking is applied per key, so a value that is masked under
`camel.sink.endpoint.<option>` is
reproduced in clear text inside the composed `camel.kamelet.ckcSink.toUrl`
value on the same line,
on every task start and on every rebalance-driven restart.
## Additional Context
Suggested direction:
- In `filterSensitive()`, sanitize the **value** as well as the key — for
example by running each
logged value through Camel's `URISupport.sanitizeUri`, which masks
userinfo and
`SensitiveUtils`-matching query options.
- Always mask the synthesized `ckcSink.toUrl` / `ckcSource.fromUrl` keys.
- Consider having `TaskHelper.buildUrl` reference sensitive options through
`RAW()`/placeholder
syntax rather than inlining resolved values.
Related: `70911aaecb` ("Fix issue #159: camel components secret options are
showed in logs") added the
key-based masking; the composed-URI path was introduced later and bypasses
it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
