AlinsRan opened a new pull request, #14157: URL: https://github.com/apache/apisix/pull/14157
### Description When data encryption is enabled, `plugin_checker` decrypts the `encrypt_fields` of every plugin in place before it validates them. If the item then fails the checker, `config_etcd` logs the whole item at `error` level, so the decrypted secrets end up in the error log. This happens on both the full load (`load_full_data`) and the watch update (`sync_data`), for every resource type whose checker calls `plugin_checker`. Failures are not limited to the plugin schema check: callers keep validating after `plugin_checker` has passed, e.g. `check_route` validates `vars`, and `stream_route_checker` validates `remote_addr` / `server_addr`. By then the item is already decrypted. Reproduction: a consumer with `key-auth.key` (encrypted in etcd) plus an invalid `limit-count`, or a route with `csrf.key` plus an invalid `vars` expression, both written to etcd directly. The error log then contains the plaintext key. Changes: - After a checker failure, `config_etcd` logs the item key (e.g. `/apisix/consumers/jack`) instead of the item value. The YAML and JSON config providers already log it this way. - The `item_schema` failure logs are unchanged. They run before the checker, so they log the value as stored in etcd. Tests: `t/node/data_encrypt_invalid_conf.t` covers the consumer case and the route `vars` case, each on a watch update and on a cold start. Each test asserts that the failure is still logged with the key and that the plaintext does not appear. Without the fix, all four tests fail. No documentation change: this only changes the content of an error log line. #### Which issue(s) this PR fixes: Fixes # ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
