xiangfu0 commented on code in PR #19884:
URL: https://github.com/apache/pinot/pull/19884#discussion_r4289061057
##########
pinot-spi/src/main/java/org/apache/pinot/spi/utils/Obfuscator.java:
##########
@@ -58,16 +58,27 @@
public final class Obfuscator {
private static final String DEFAULT_MASKED_VALUE = "*****";
+ /// Suffix-anchored, so that a key is masked for what it ends in and a
structural name such as
+ /// `pinot.broker.auth.provider.class` stays readable. Beyond the generic
credential words, this covers
+ /// credentials whose key does not end in one: the AWS access and secret key
pair, dotted or not (as in
+ /// `input.fs.prop.accessKey`, `fs.s3a.access.key` and `fs.s3a.secret.key`),
the Azure storage
+ /// `account.key`, Kafka's `sasl.jaas.config`, Confluent's
`basic.auth.user.info` (a literal
+ /// `user:password`), and inline private or service-account key material.
Key *file* names are not
+ /// masked, because their values are paths rather than secrets.
private static final List<Pattern> DEFAULT_PATTERNS =
- Stream.of("(?i).*secret$", "(?i).*secret[\\s_-]*key$",
"(?i).*api[\\s_-]*key$", "(?i).*password$",
- "(?i).*keytab$", "(?i).*token$")
+ Stream.of("(?i).*secret$", "(?i).*secret[\\s._-]*key$",
"(?i).*api[\\s._-]*key$", "(?i).*password$",
Review Comment:
Nice — adding `.` to `secret[\s._-]*key$` (and `api[\s._-]*key$`) closes the
S3A secret-key gap symmetrically with the access key. Verified
`fs.s3a.secret.key` now masks while `fs.s3a.aws.credentials.provider` stays
readable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
