membphis commented on PR #14162: URL: https://github.com/apache/apisix/pull/14162#issuecomment-6757220868
Follow-up on the plaintext logging concern: The full-configuration logging sinks predate this PR, but this PR expands the set of secrets that can reach them as plaintext. The new reader recursively decrypts every `$ENC$v1$` value regardless of `encrypt_fields` in the current release, and it adds marker decryption to stream plugin configurations. As a result, values that previously remained ciphertext or an unrecognized marked string can now be passed to existing whole-configuration logs as plaintext. Confirmed paths include: 1. `stream_plugin_checker` decrypts marked values and then calls `stream_check_schema`, which logs the complete `plugin_conf` at INFO level. A marked `limit-conn.redis_password` is therefore logged during an otherwise successful stream configuration load. 2. `plugin_checker` decrypts marked values before schema validation. If an unrelated field fails validation, the full-load and incremental-watch failure paths in `config_etcd.lua` serialize the already-mutated resource, including the decrypted secret. 3. Normal route/service and stream-route/service merges log the complete configurations after they have been loaded and decrypted; `conf_version` also logs a serialized plugin configuration when its version is first calculated. The underlying cleanup is broader than the marker implementation, so it is acceptable to complete it in a separate PR rather than duplicate the full fix here. #14157 already removes or narrows these whole-configuration log statements. That follow-up should retain regression coverage proving that a marked plaintext secret is absent from logs on both a successful stream load and a checker-failure path, so this expanded exposure is not reintroduced. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
