Andrea Cosentino created CAMEL-24891:
----------------------------------------
Summary: camel-debezium - generated password options are not
marked as secret
Key: CAMEL-24891
URL: https://issues.apache.org/jira/browse/CAMEL-24891
Project: Camel
Issue Type: Bug
Components: camel-debezium
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
h3. Summary
None of the password options generated for the Debezium connectors is marked
{{secret = true}}, so
the catalog advertises them as ordinary strings.
h3. Details
{{ConnectorConfigGenerator.setClassFields()}} emits {{label}}, {{defaultValue}}
and {{javaType}} on
{{@UriParam}} and {{@Metadata(required = true)}} where applicable, but never
{{secret}}:
{code:java}
final Annotation annotation = field.addAnnotation(UriParam.class)
.setLiteralValue("label", "LABEL_NAME");
...
if (fieldConfig.isRequired()) {
field.addAnnotation(Metadata.class)
.setLiteralValue("required", "true");
}
{code}
Affected options across the six connectors: {{databasePassword}} (db2, mysql,
oracle, postgres,
sqlserver), {{mongodbPassword}}, {{databaseSslTruststorePassword}} and
{{databaseSslKeystorePassword}} (mysql), {{databaseSslpassword}} (postgres).
All of them carry
{{"secret": false}} in the generated catalog JSON.
h3. Scope
This is a catalog/metadata gap, not a log leak: {{URISupport.ALL_SECRETS}}
matches any query
parameter whose *key contains* a sensitive keyword, so
{{?databasePassword=...}} is already redacted
in logs and JMX. What is wrong is what the catalog tells tooling - Kaoto, the
VS Code extension and
JBang completion render these as plain text fields, and the generated option
tables do not flag
them. CLAUDE.md asks for {{secret = true}} on passwords, tokens and API keys.
h3. Proposed fix
{{ConnectorConfigField}} already wraps the connector's {{ConfigDef.ConfigKey}}
and already switches
on {{ConfigDef.Type.PASSWORD}} when mapping the Java type, so the generator can
set
{{secret = true}} from the same signal. Regenerating the six connector modules
then flips
{{"secret": true}} in the catalog.
----
_Reported by Claude Code on behalf of oscerd (Andrea Cosentino)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
