deshmukhpurushothaman opened a new pull request, #19775:
URL: https://github.com/apache/pinot/pull/19775
## Summary
Fixes #19774
- `StreamConfig#toString()` logs its raw
`_streamConfigMap`/`_decoderProperties` maps, which leak plaintext
credentials (e.g. a Kafka `sasl.jaas.config` username/password) whenever a
stream-related error is logged,
such as a failed `StreamMessageDecoder` initialization on the server.
- Masks values for sensitive-looking keys using the existing `Obfuscator`
utility, and additionally redacts
`username=`/`password=` pairs embedded inside a single composite value (as
in a JAAS login-module string),
which key-based masking alone can't reach.
## Test plan
- [ ] Verified manually: constructed a `StreamConfig` with a
`sasl.jaas.config` JAAS string and an
`ssl.keystore.password` key, confirmed `toString()` output has both
redacted while other fields
(topic, decoder class, timeouts) remain readable.
- [ ] Existing `StreamConfig`/`Obfuscator` unit tests pass (none assert on
exact `toString()` format).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
