AlinsRan commented on PR #14162: URL: https://github.com/apache/apisix/pull/14162#issuecomment-6757389919
Thanks. The regression coverage is in #14157 as commit 38a145d3dc59934e0404287192fc9f4685a9214f (`t/node/plugin-conf-log-secret.t`). #14157 already removes or narrows all three log paths you listed, so the commit only adds tests. Each test asserts that the secret is absent from the error log: - **Successful stream load, at info level (TEST 1 and TEST 2).** A stream route uses a service and carries `limit-conn` with `redis_password`. The route is created through the Admin API, then loaded when the stream subsystem starts and hit with a stream request. This runs `stream_check_schema` (path 1), `merge_service_stream_route` and `conf_version` (path 3). - **Checker failure on an unrelated field (TEST 3 and TEST 4).** A route is created with `limit-count` and `redis_password`. An invalid `response-rewrite` conf is then written to etcd directly, so Admin API validation is bypassed. TEST 3 covers the incremental-watch failure log in `sync_data` and TEST 4 covers the full-load failure log in `load_full_data` (path 2). The tests use a plaintext secret, so they do not depend on this PR. The statements they guard serialize the in-memory conf, and in that conf a plaintext value and a decrypted marked value are the same string. The plaintext value therefore reaches exactly the log statements that a decrypted `$ENC$v1$` value would reach. I checked that the tests can fail: restoring any one of the five removed statements (the full-conf `stream_check_schema` log, the stream-route conf log in `merge_service_stream_route`, the `conf_version` source dump, and the `val:` dumps in `sync_data` and `load_full_data`) makes the matching test fail. A variant that stores a `$ENC$v1$` marked secret will be added once both PRs are on master, in whichever of the two merges second. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
