det101 opened a new issue, #18588: URL: https://github.com/apache/dolphinscheduler/issues/18588
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/dolphinscheduler/issues?q=is%3Aissue) and found no similar feature requirement. ### Description Subtask of #17937 (DSIP-105). Depends on #18586 (`Property.sensitive` available on runtime params). Does **not** require the encryption subtask. Dynamically redact this task’s sensitive parameter **plaintext values** from task stdout / agreed task log paths. #### In scope - Input: this task’s `prepareParamsMap` (or equivalent context) values where `sensitive=true` - Behavior: if those values appear in the task log, replace with `******` (extend existing `SensitiveDataConverter` or equivalent with **per-task dynamic** patterns) - Lifecycle: register at task start; **must clear** on task end (success / failure / kill) - Must not leak static/global mask state into later unrelated tasks - Coverage: Physical task execution stdout / task logs; unit tests + log assertions #### Out of scope - Project parameters - Replacing definition-time encryption - Claiming coverage of every plugin custom log file - API/UI masking (already #18586) #### Acceptance - [ ] Sensitive param values printed by a script do not appear in the task log (shown as `******`) - [ ] After the task ends (including failure / kill), mask patterns are cleaned up - [ ] Two tasks in sequence or in parallel do not pollute each other’s logs - [ ] Unit tests for register / cleanup; concurrent or sequential non-interference ### Use case After API/UI masking, the remaining common leak is task logs (`echo ${password}`). Operators viewing task logs must not see those secrets. ### Related issues - Parent DSIP: #17937 - Depends on: #18586 ### Are you willing to submit a PR? - [x] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
