AlinsRan commented on PR #14162:
URL: https://github.com/apache/apisix/pull/14162#issuecomment-6676460017
@membphis Thanks, confirmed. Some notes on scope:
- The same class of leak already exists on master. `plugin_checker` decrypts
`encrypt_fields` in place before `check_schema`, and resource checkers such as
`check_route` (`vars`) or `stream_route_checker` (addresses) run after it. When
any of these rejects the resource, `config_etcd.lua` logs the object with the
plaintext. A copy inside `plugin_checker` would not cover the outer checks, so
the fix belongs in those failure logs. #14157 changes all three checker-failure
logs (full load, watch, single read) to print only the key.
- Plugin metadata was the one exposure this PR added: master decrypts
metadata only after its schema check passes. `check_plugin_metadata` now
decrypts and validates a copy and replaces the entry only once the check passes
(d36c40b4), so a rejected entry is logged with its values still encrypted.
- I added regressions to `t/node/data_encrypt_marker.t`. Each one writes a
decryptable marked value together with an unrelated error and asserts the
plaintext is never logged:
- a plugin schema error (TEST 4);
- a route `vars` error (TEST 5);
- a plugin metadata schema error (TEST 13).
- TEST 4 and 5 pass with #14157's `config_etcd.lua` and fail without it.
This PR therefore depends on #14157 and should merge after it; the description
now says so.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
