[
https://issues.apache.org/jira/browse/CAMEL-24891?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18117951#comment-18117951
]
Andrea Cosentino commented on CAMEL-24891:
------------------------------------------
PR opened: https://github.com/apache/camel/pull/26735
Both generator defects share one regeneration of the six connector modules, so
they are fixed in one PR with a commit each. Verified by reverting each fix and
re-running: the matching new test fails on its own assertion.
----
_Claude Code on behalf of oscerd (Andrea Cosentino)._
> camel-debezium - generated password options are not marked as secret
> --------------------------------------------------------------------
>
> Key: CAMEL-24891
> URL: https://issues.apache.org/jira/browse/CAMEL-24891
> Project: Camel
> Issue Type: Bug
> Components: camel-debezium
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
>
> h3. Summary
> None of the password options generated for the Debezium connectors is marked
> {{secret = true}}, so
> the catalog advertises them as ordinary strings.
> h3. Details
> {{ConnectorConfigGenerator.setClassFields()}} emits {{label}},
> {{defaultValue}} and {{javaType}} on
> {{@UriParam}} and {{@Metadata(required = true)}} where applicable, but never
> {{secret}}:
> {code:java}
> final Annotation annotation = field.addAnnotation(UriParam.class)
> .setLiteralValue("label", "LABEL_NAME");
> ...
> if (fieldConfig.isRequired()) {
> field.addAnnotation(Metadata.class)
> .setLiteralValue("required", "true");
> }
> {code}
> Affected options across the six connectors: {{databasePassword}} (db2, mysql,
> oracle, postgres,
> sqlserver), {{mongodbPassword}}, {{databaseSslTruststorePassword}} and
> {{databaseSslKeystorePassword}} (mysql), {{databaseSslpassword}} (postgres).
> All of them carry
> {{"secret": false}} in the generated catalog JSON.
> h3. Scope
> This is a catalog/metadata gap, not a log leak: {{URISupport.ALL_SECRETS}}
> matches any query
> parameter whose *key contains* a sensitive keyword, so
> {{?databasePassword=...}} is already redacted
> in logs and JMX. What is wrong is what the catalog tells tooling - Kaoto, the
> VS Code extension and
> JBang completion render these as plain text fields, and the generated option
> tables do not flag
> them. CLAUDE.md asks for {{secret = true}} on passwords, tokens and API keys.
> h3. Proposed fix
> {{ConnectorConfigField}} already wraps the connector's
> {{ConfigDef.ConfigKey}} and already switches
> on {{ConfigDef.Type.PASSWORD}} when mapping the Java type, so the generator
> can set
> {{secret = true}} from the same signal. Regenerating the six connector
> modules then flips
> {{"secret": true}} in the catalog.
> ----
> _Reported by Claude Code on behalf of oscerd (Andrea Cosentino)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
