gavinchou opened a new pull request, #69467:
URL: https://github.com/apache/doris/pull/69467
### What problem does this PR solve?
Issue Number: N/A
Problem Summary:
SQL masking in FE execution logs rebuilds entire property lists, losing
their line breaks, indentation, comments and original key formatting. Some
retry, internal query and HTTP stream planning logs also print the original
SQL. Parser exceptions can repeat the original SQL in their diagnostic text
even when the main log message uses a masked statement.
Reuse the audit masking parser and the existing sensitive/hidden property
key policies, with a formatting-preserving mode that replaces only sensitive
values. Use this shared path for StmtExecutor SQL logs before and after
parsing, including statements whose audit-encryption flag is false. Convert
parser code-point offsets to Java character offsets so supplementary characters
cannot shift the masked ranges. Keep audit logging's existing formatting and
dispatch behavior.
Masking failures return a fixed placeholder. Logs for masking and syntax
failures record the exception type without input-bearing exception messages or
stack traces. Logging pre-processing does not apply execution hints.
### Release note
FE execution logs preserve SQL line breaks and formatting while masking
recognized credential values. Syntax-error diagnostics no longer repeat the
original SQL.
### Check List (For Author)
- Test
- [x] Unit Test: 35 focused tests passed: EncryptSQLTest (6),
DatasourcePrintableMapTest (20), and StmtExecutorTest (9 selected methods).
Coverage includes exact formatting, Unicode, hidden keys, CTAS/EXPLAIN,
execution hints, empty SQL, syntax failures and masking failures.
- [ ] Regression test
- [ ] Manual test
- Checkstyle: passed with zero violations.
- An initial unfiltered reactor run stopped in the unrelated Iceberg
S3TablesTest because Apache5HttpClient.Builder was missing; the focused run
excludes that test.
- Behavior changed:
- [x] Yes. FE SQL logs preserve formatting and consistently mask
recognized credentials; audit log behavior is unchanged.
- Does this need documentation?
- [x] No. No configuration or SQL interface changes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
