deshmukhpurushothaman opened a new issue, #19774:
URL: https://github.com/apache/pinot/issues/19774
## Description
`StreamConfig#toString()` prints its `_streamConfigMap` and
`_decoderProperties` maps verbatim. These maps
hold the raw, unvalidated `streamConfigs` from the table config, which for
Kafka can include
`sasl.jaas.config` — a single string containing a plaintext
username/password:
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule
required username="exampleUser" password="examplePass";
Whenever `StreamConfig#toString()` ends up in a log line — e.g.
`RealtimeSegmentDataManager#createMessageDecoder`
wraps and logs `_streamConfig` on any decoder-initialization failure
(`pinot-core/.../RealtimeSegmentDataManager.java`, `createMessageDecoder`) —
this credential is written to
the server log in plaintext.
## Proposed fix
Mask sensitive values in `StreamConfig#toString()`:
- Reuse the existing `Obfuscator` utility (`pinot-spi/.../Obfuscator.java`)
to mask whole values for
keys that look sensitive (password/secret/token/apiKey/keytab suffixes) —
this already covers configs
like `ssl.keystore.password`.
- Additionally redact `username="..."`/`password="..."` pairs *embedded
inside* a single value (as in the
JAAS login-module string above), since Obfuscator's key-based matching
can't reach into a compound value.
## Impact
Logging only — no functional/behavioral change to stream consumption. No
wire/serialization format change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
