search

apache / pinot

Apache Pinot - A realtime distributed OLAP datastore
https://pinot.apache.org/
Apache License 2.0
5.26k stars 1.23k forks source link

Auth Token should not go into Logs #8363

Closed KKcorps closed 2 years ago

KKcorps commented 2 years ago

Currently we push SegmentGenerationJobSpec into logs in the following place https://github.com/apache/pinot/blob/7e9ca6a5a4afe0d4e283ac1307c45430e474cbf2/pinot-spi/src/main/java/org/apache/pinot/spi/ingestion/batch/IngestionJobLauncher.java#L100

This may be problematic from security perspective since job spec can contain authToken, username, password as well.

We should avoid logging these fields.

Changes might be needed in other classes as well where we log these fields as well.

mayankshriv commented 2 years ago

@KKcorps can this issue be closed, seems like the fixes were already merged?