venkateshwaracholan opened a new pull request, #4772: URL: https://github.com/apache/polaris/pull/4772
Fixes #4771 ## Summary The Python CLI debug logging implementation currently logs request and response headers and payloads directly to stderr, which may expose sensitive authentication data. This change introduces sanitization of debug output before it is logged. ### Changes - Add reusable log sanitization helpers - Redact sensitive headers such as Authorization and realm-related headers - Redact secrets in JSON and form-urlencoded payloads - Redact OAuth token request and response payloads - Add defensive handling for malformed payloads - Add unit and integration tests covering credential redaction scenarios ### Testing Added tests for: - Authorization header redaction - OAuth token request redaction - OAuth token response redaction - Nested secret redaction - Realm header redaction - Malformed payload handling - End-to-end debug logging behavior ### Risk Low. Changes affect only debug logging behavior and do not modify request handling, authentication, or API functionality. ## Checklist - [ ] ๐ก๏ธ Don't disclose security issues! (contact [email protected]) - [ ] ๐ Clearly explained why the changes are needed, or linked related issues: Fixes # - [ ] ๐งช Added/updated tests with good coverage, or manually tested (and explained how) - [ ] ๐ก Added comments for complex logic - [ ] ๐งพ Updated `CHANGELOG.md` (if needed) - [ ] ๐ Updated documentation in `site/content/in-dev/unreleased` (if needed) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
