LuciferYang opened a new issue, #7727:
URL: https://github.com/apache/kyuubi/issues/7727
### Describe the bug
`genKeyValuePair` assembles a `key=value` command-line argument by trimming
only the concatenated string:
```scala
def genKeyValuePair(key: String, value: String): String = s"$key=$value".trim
```
`.trim` on the whole string strips the outer ends but leaves any whitespace
between the key and the value. `genKeyValuePair("abc ", "123")` returns `"abc
=123"`, with the space kept before the `=`, so the trim the method advertises
is only half applied.
This has a concrete consequence for secret redaction. `redactConfValues`
splits each assembled argument on `=` and matches the key against an exact key
set. When a conf key carries stray whitespace, the assembled argument is
`"<key> =<value>"`, so the extracted key `"<key> "` misses the exact set and
the value is not redacted.
The gap is reachable for the Data Agent engine's API key.
`kyuubi.engine.data.agent.openai.api.key` is not matched by the default
pattern-based redaction (`secret|password|token|access.key`), so exact-key
redaction is the only stage that would mask it. Session conf keys are not
trimmed on the way through, so a key submitted with a trailing space escapes
that stage and the API key value lands in the engine launch command written to
the server log.
### Affects Version(s)
master (1.13.0-SNAPSHOT), and earlier releases carrying `kyuubi-util-scala`.
### Are you willing to submit PR?
Yes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
