wenzhenghu opened a new issue, #65875: URL: https://github.com/apache/doris/issues/65875
### Search before asking\n\n- [x] I searched the existing open and closed issues and found no similar issue.\n\n### Description\n\nFE diagnostic logs are produced by multiple SQL processing paths, and these paths do not currently share one consistent policy for handling sensitive property values.\n\nRemoving the complete SQL text from logs makes production troubleshooting significantly harder. The desired behavior is to preserve the SQL structure, identifiers, and other non-sensitive content while redacting only values associated with confirmed sensitive fields, such as passwords, access keys, secret keys, tokens, SASL credentials, and equivalent connector-specific properties.\n\nThis issue tracks a general FE logging improvement and hardening effort. It is not intended to describe or track a specific vulnerability.\n\n### Proposed solution\n\nIntroduce a shared SQL log redaction facility with the following properties:\n\n1. Preserve non-sensitive SQL content and statement structu re so that logs remain useful for diagnosis.\n2. Replace only the values of known sensitive fields. Reuse a central sensitive-key registry where possible and support statement-specific keys for resources, stages, routine load, catalogs, repositories, and similar property-bearing statements.\n3. Provide consistent handling for:\n - successfully parsed statements;\n - parser-error paths;\n - SQL dialect conversion paths;\n - statements whose parser or plan object is unavailable.\n4. Use a fail-safe fallback: if the redactor cannot safely process a statement, do not emit the original SQL from that path. Log metadata such as query ID, statement type, length, user, dialect, and error type for that event instead.\n5. Migrate the main FE diagnostic logging entry points to the shared facility, including:\n - StmtExecutor and ConnectProcessor;\n - HTTP statement execution endpoints;\n - parser and dialect-conversion logging;\n - Load command logging;\n - CBO/rewrite logging ;\n - query profile logging.\n6. Keep the regular diagnostic-log policy aligned with, but clearly separated from, audit-log encryption behavior.\n\n### Tests\n\nAdd log-capture tests that verify:\n\n- known sensitive values never appear in emitted logs;\n- SQL structure and non-sensitive content remain available;\n- statement-specific sensitive keys are handled;\n- parser failures and dialect-conversion failures use the safe fallback;\n- all migrated entry points apply the same policy.\n\n### Are you willing to submit PR?\n\n- [ ] Yes, I am willing to submit a PR.\n\n### Code of Conduct\n\n- [x] I agree to follow this project's Code of Conduct. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
