luoluoyuyu commented on PR #18476:
URL: https://github.com/apache/iotdb/pull/18476#issuecomment-5290385566
The change narrows the audit-database exclusion from "all pipe types" to
"SUBSCRIPTION only", which means **USER pipes now also start capturing audit
data** (`__audit` / `root.__audit`). The PR description only explains why
CONSENSUS pipes need it (audit-region migration), but not why USER pipes should
be opened up as well.
In the current master,
`DataRegionListeningFilter.shouldDataRegionBeListened` /
`shouldDatabaseBeListened` unconditionally exclude audit databases for every
pipe type (no `pipeType` parameter). With this change, an existing user pipe
using a broad pattern such as `root.**` will, after upgrade, silently begin
replicating audit data to the remote end — a behavior change that also
increases write amplification and may expose sensitive audit records outside
the cluster.
Could we scope the change to **CONSENSUS only**, i.e. keep `isAuditDatabase`
excluded for both SUBSCRIPTION and USER?
```java
if (!PipeType.CONSENSUS.equals(pipeType) &&
isAuditDatabase(databaseRawName)) {
return false;
}
```
If opening audit data to USER pipes is intentional, please document the
rationale and the upgrade impact in the PR description.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
