FrankChen021 opened a new pull request, #20663: URL: https://github.com/apache/druid/pull/20663
### Description Runtime property values containing credentials leak in several places. This PR fixes them by applying one list of sensitive property names everywhere. #### Docker startup scripts no longer log property values `setKey` in `distribution/docker/druid.sh` and `peon.sh` logged every property it set, e.g. `Setting druid.auth.authenticator.MyBasicAuthenticator.initialAdminPassword=xxx in ...`. It now logs only the key and the target file. #### Use `druid.server.hiddenProperties` everywhere Sensitive properties were protected by two separate lists, so a property hidden in one place could leak in another: | Where | Before | After | |---|---|---| | Startup property log | `druid.startup.logging.maskProperties`, case-sensitive | `druid.server.hiddenProperties`, case-insensitive | | `ForkingTaskRunner` task command log | `druid.startup.logging.maskProperties`, case-sensitive | `druid.server.hiddenProperties`, case-insensitive | | `/status/properties` (`sys.server_properties`) | `druid.server.hiddenProperties`, case-insensitive | unchanged | For example, `ForkingTaskRunner` passes runtime properties to the peon as `-D` arguments, so `druid.s3.accessKey` or `druid.zk.service.pwd` were printed on every task launch. The default of `druid.server.hiddenProperties` gains `secret`, `passphrase` (e.g. `druid.auth.pac4j.cookiePassphrase`), `basicAuthentication` (e.g. `druid.emitter.http.basicAuthentication`) and `druid.emitter.kafka.producer.hiddenProperties`. `druid.startup.logging.maskProperties` is deprecated; its words are still applied. If it is not set, its former default (`password`, `secret`) is still applied, so logs are never masked less than before. The example configs are updated to the new default. #### Remove property masking from the Kubernetes task adapters `K8sTaskAdapter` masked its logged peon command, but that command (`/peon.sh ... --taskId <id>`) never contains property values, so the masking had no effect. The unused `StartupLoggingConfig` parameter is removed. #### Release note - The Druid docker startup scripts no longer print property values to the logs. - `druid.server.hiddenProperties` now also masks property values in the startup property log and task command logs, matched case-insensitively, and its default covers more credential properties. - `druid.startup.logging.maskProperties` is deprecated; its values are still honored. Migrate to `druid.server.hiddenProperties`. <hr> This PR has: - [x] been self-reviewed. - [x] added documentation for new or modified features or behaviors. - [x] a release note entry in the PR description. - [x] added unit tests or modified existing tests to cover new code paths. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
