nic-6443 opened a new pull request, #14049: URL: https://github.com/apache/apisix/pull/14049
### Description When a `$secret://` reference can't be resolved, `apisix/secret.lua` logs the provider's error at error level. Two providers put the fetched content into that error: - aws: if the reference has a field (`$secret://aws/<id>/<secret>/<field>`) but the stored secret string isn't JSON, the decode error included the whole secret string, i.e. the plaintext secret ended up in `error.log`. - vault: if the response has no `data` field, the error included the raw response body. Both errors now carry only identifiers: the AWS secret name and field, and the vault path. Nothing else changes, the lookup logic and return values are the same. The new cases in `t/secret/aws.t` and `t/secret/vault.t` resolve such a reference through `fetch_secrets` and assert the error is logged without the secret value or response body. Both fail on current master and pass with this change. The aws case uses the existing `apisix/full/path` localstack fixture; the vault case serves the response from a test location, so it doesn't need a vault server. Heads-up: #14047 also touches `apisix/secret/aws.lua` and `apisix/secret/vault.lua`. This diff is limited to the two error-message lines so the two should merge cleanly; whichever lands second should merge master and re-check. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change (not needed, only error log content changes) - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
