shantanushukla opened a new pull request, #23312: URL: https://github.com/apache/kafka/pull/23312
JIRA: https://issues.apache.org/jira/browse/KAFKA-20964 `kafka-storage format --add-scram` parses SCRAM credentials in `ScramParser`. On Base64 decode failure, `PerMechanismData` built a `FormatterException` whose message included the user-supplied `saltedpassword` (and the same for `salt`). `StorageTool` prints `getMessage()` to stderr, so credential-adjacent input was echoed in the CLI error. ### Fix Use a generic decode-failure message and keep the `IllegalArgumentException` as the cause. Do not concatenate the user-supplied value. ``` Failed to decode given saltedPassword Failed to decode given salt ``` This matches the existing request-side practice of not printing salt or salted password (`AlterUserScramCredentialsRequest`). Decode details remain on the cause if it is logged. ### Why existing tests missed this `ScramParserTest` covered valid Base64 `saltedpassword`/`salt` and missing-field errors (`name`, `password`, `salt` required with `saltedpassword`, extra keys). None of those paths throw on Base64 failure, so the decode-error message was never asserted. ### Tests These failed on trunk (message included the raw input) and pass after this change: - `testParsePerMechanismDataFailsWithInvalidSaltedPasswordBase64` — valid salt so construction reaches the salted-password decoder; `saltedpassword="not-valid-base64!!!"`. Trunk: `Failed to decode given saltedPassword: not-valid-base64!!!`. After: `Failed to decode given saltedPassword`. - `testParsePerMechanismDataFailsWithInvalidSaltBase64` — `salt="%%%"`. Trunk: `Failed to decode given salt: %%%`. After: `Failed to decode given salt`. Related existing tests still pass: full `ScramParserTest` (including valid `saltedpassword` parse and `toRecord()`). ``` ./gradlew :metadata:test --tests org.apache.kafka.metadata.storage.ScramParserTest :metadata:checkstyleMain :metadata:checkstyleTest :metadata:spotlessCheck ``` BUILD SUCCESSFUL. This work is original and is licensed to the Apache Kafka project under the Apache License, Version 2.0. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
