This is an automated email from the ASF dual-hosted git repository.
nic-6443 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new c4f09e1f82 fix(secret): do not include secret values in aws and vault
error messages (#14049)
c4f09e1f82 is described below
commit c4f09e1f8297f5d825c26b9de310688b0fc127a8
Author: Nic <[email protected]>
AuthorDate: Thu Oct 22 09:41:27 2026 +0800
fix(secret): do not include secret values in aws and vault error messages
(#14049)
---
apisix/secret/aws.lua | 3 ++-
apisix/secret/vault.lua | 2 +-
t/secret/aws.t | 39 +++++++++++++++++++++++++++++++++++++++
t/secret/vault.t | 43 +++++++++++++++++++++++++++++++++++++++++--
4 files changed, 83 insertions(+), 4 deletions(-)
diff --git a/apisix/secret/aws.lua b/apisix/secret/aws.lua
index a538c2c7ea..625fdf324c 100644
--- a/apisix/secret/aws.lua
+++ b/apisix/secret/aws.lua
@@ -136,7 +136,8 @@ function _M.get(conf, key)
local data, err = core.json.decode(res)
if not data then
- return nil, "failed to decode result, res: " .. res .. ", err:
" .. err
+ return nil, "failed to decode result, secret: " .. main_key
+ .. ", field: " .. sub_key .. ", err: " .. err
end
return data[sub_key]
diff --git a/apisix/secret/vault.lua b/apisix/secret/vault.lua
index 40b5d404bd..2fb0e4fb04 100644
--- a/apisix/secret/vault.lua
+++ b/apisix/secret/vault.lua
@@ -110,7 +110,7 @@ local function get(conf, key)
local ret = core.json.decode(res)
if not ret or not ret.data then
- return nil, "failed to decode result, res: " .. res
+ return nil, "failed to decode result, path: " .. main_key
end
return ret.data[sub_key]
diff --git a/t/secret/aws.t b/t/secret/aws.t
index ce6c81daeb..3cd7d7588e 100644
--- a/t/secret/aws.t
+++ b/t/secret/aws.t
@@ -408,3 +408,42 @@ GET /t
}
--- response_body
secret value: value
+
+
+
+=== TEST 12: the secret value is not logged when it is not JSON but a field is
requested
+--- request
+GET /t
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/secrets/aws/mysecret',
+ ngx.HTTP_PUT,
+ [[{
+ "endpoint_url": "http://127.0.0.1:4566";,
+ "region": "us-east-1",
+ "access_key_id": "access",
+ "secret_access_key": "secret",
+ "session_token": "token"
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ return ngx.say(body)
+ end
+
+ ngx.sleep(1)
+
+ local secret = require("apisix.secret")
+ local refs = secret.fetch_secrets({key =
"$secret://aws/mysecret/apisix/full/path/field"})
+ ngx.say(refs.key)
+ }
+ }
+--- response_body
+$secret://aws/mysecret/apisix/full/path/field
+--- error_log
+failed to decode result, secret: apisix/full/path, field: field
+--- no_error_log
+full-value
+--- timeout: 10
diff --git a/t/secret/vault.t b/t/secret/vault.t
index 607604f7ac..f2dc7cb7c7 100644
--- a/t/secret/vault.t
+++ b/t/secret/vault.t
@@ -210,7 +210,7 @@ value
--- request
GET /t
--- response_body_like
-failed to decode result, res: \{\"errors\":\[\"permission denied\"\]}\n
+failed to decode result, path: /apisix-key/jack
@@ -235,7 +235,7 @@ failed to decode result, res: \{\"errors\":\[\"permission
denied\"\]}\n
--- request
GET /t
--- response_body_like
-failed to decode result, res: \{\"errors\":\[\"permission denied\"\]}\n
+failed to decode result, path: /apisix-key/jack
@@ -293,3 +293,42 @@ passed
GET /t
--- error_log
HCV_NAMESAPCE:apisix
+
+
+
+=== TEST 12: the response body is not logged when it has no data field
+--- request
+GET /t
+--- config
+ location /v1/kv/apisix/leak {
+ return 200 '{"warnings":["vault-body-sentinel"]}';
+ }
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/secrets/vault/leak',
+ ngx.HTTP_PUT,
+ [[{
+ "uri": "http://127.0.0.1:1984";,
+ "prefix": "kv/apisix",
+ "token": "root"
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ return ngx.say(body)
+ end
+
+ ngx.sleep(1)
+
+ local secret = require("apisix.secret")
+ local refs = secret.fetch_secrets({key =
"$secret://vault/leak/leak/key"})
+ ngx.say(refs.key)
+ }
+ }
+--- response_body
+$secret://vault/leak/leak/key
+--- error_log
+failed to decode result, path: leak
+--- no_error_log
+vault-body-sentinel
