(apisix) branch master updated: fix: avoid logging plaintext value when encrypt/decrypt fails in ssl.lua (#13298)

[nic443]

This is an automated email from the ASF dual-hosted git repository.

nic-6443 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git


The following commit(s) were added to refs/heads/master by this push:
     new c8bab5d97 fix: avoid logging plaintext value when encrypt/decrypt 
fails in ssl.lua (#13298)
c8bab5d97 is described below

commit c8bab5d97afba64fbff53e28ed38766ec45fa077
Author: Nic <qiany...@api7.ai>
AuthorDate: Mon Apr 27 10:07:13 2026 +0800

    fix: avoid logging plaintext value when encrypt/decrypt fails in ssl.lua 
(#13298)
---
 apisix/ssl.lua        | 6 +++---
 t/lib/test_admin.lua  | 2 +-
 t/node/data_encrypt.t | 4 ++++
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/apisix/ssl.lua b/apisix/ssl.lua
index 2bd757077..42720b75a 100644
--- a/apisix/ssl.lua
+++ b/apisix/ssl.lua
@@ -119,7 +119,7 @@ end
 local function encrypt(aes_128_cbc_with_iv, origin)
     local encrypted = aes_128_cbc_with_iv:encrypt(origin)
     if encrypted == nil then
-        core.log.error("failed to encrypt key[", origin, "] ")
+        core.log.error("failed to encrypt key")
         return origin
     end
 
@@ -159,8 +159,8 @@ local function aes_decrypt_pkey(origin, field)
 
     local decoded_key = ngx_decode_base64(origin)
     if not decoded_key then
-        core.log.error("base64 decode ssl key failed. key[", origin, "] ")
-        return nil
+        core.log.error("base64 decode ssl key failed")
+        return nil, "base64 decode ssl key failed"
     end
 
     for _, aes_128_cbc_with_iv in ipairs(aes_128_cbc_with_iv_tbl) do
diff --git a/t/lib/test_admin.lua b/t/lib/test_admin.lua
index 18caf813b..d6aa87c71 100644
--- a/t/lib/test_admin.lua
+++ b/t/lib/test_admin.lua
@@ -258,7 +258,7 @@ function _M.aes_encrypt(origin)
     if aes_128_cbc_with_iv ~= nil and str_find(origin, "---") then
         local encrypted = aes_128_cbc_with_iv:encrypt(origin)
         if encrypted == nil then
-            core.log.error("failed to encrypt key[", origin, "] ")
+            core.log.error("failed to encrypt key")
             return origin
         end
 
diff --git a/t/node/data_encrypt.t b/t/node/data_encrypt.t
index 0dece7d46..d166cb480 100644
--- a/t/node/data_encrypt.t
+++ b/t/node/data_encrypt.t
@@ -335,6 +335,8 @@ bar
 bar
 --- error_log
 failed to decrypt the conf of plugin [basic-auth] key [password], err: decrypt 
ssl key failed
+--- no_error_log
+key\[bar\]
 
 
 
@@ -395,6 +397,8 @@ bar
 vU/ZHVJw7b0XscDJ1Fhtig==
 --- error_log
 failed to decrypt the conf of plugin [basic-auth] key [password], err: decrypt 
ssl key failed
+--- no_error_log
+key\[bar\]