bobhan1 opened a new pull request, #66917: URL: https://github.com/apache/doris/pull/66917
## What problem does this PR solve? Backport #66618 to `branch-4.1`. Authentication credentials could be exposed by HTTP authentication and Stream Load diagnostic logs. Several FE and BE paths formatted complete requests containing `passwd`, `token`, `auth_code`, or `auth_code_uuid`; the deprecated `auth_code` header was also missing from the sensitive-header filter, and invalid-token errors included the token value. ## What is changed? - Log sanitized copies of authentication and Stream Load requests. - Mask `passwd`, `token`, and `auth_code_uuid`, and omit numeric `auth_code` from log-only copies. - Treat the `auth_code` HTTP header as sensitive in FE and BE. - Remove invalid token values from authentication errors. - Preserve the `branch-4.1` JUnit4/JMockit test structure while porting the new FE log assertion. User impact: authentication failures and Stream Load diagnostics retain non-sensitive request context without emitting these credential values. ## Validation - `./run-fe-ut.sh --run org.apache.doris.common.util.ThriftLogHelperTest,org.apache.doris.service.FrontendServiceImplTest,org.apache.doris.load.StreamLoadHandlerTest` — 25 tests passed, 0 failures/errors. - `clang-format --dry-run --Werror be/src/load/stream_load/stream_load_executor.cpp be/src/service/http/http_handler_with_auth.cpp be/src/service/http/http_request.cpp be/test/service/http/http_auth_test.cpp` - `git diff --check upstream/branch-4.1...HEAD` - BE UT was not rerun locally for this backport; upstream #66618 reported its targeted BE tests passing on master. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
