You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by "iaorekhov-1980 (via GitHub)" <gi...@apache.org> on 2026/04/06 15:41:10 UTC

[I] [Enhancement] (nereids) improve masking of users' password in the audit logs [doris]

iaorekhov-1980 opened a new issue, #62140:
URL: https://github.com/apache/doris/issues/62140

   ### Search before asking
   
   - [x] I had searched in the [issues](https://github.com/apache/doris/issues?q=is%3Aissue) and found no similar issues.
   
   
   ### Description
   
   In current implementation values of users' passwords are masked for SET PASSWORD and SET LDAP_ADMIN_PASSWORD operations.
   It is covered by LogicalPlanBuilderForEncryption class
   https://github.com/apache/doris/blob/a8c890545ecb86fcf0516e4ff6b7c53f2635aed0/fe/fe-core/src/main/java/org/apache/doris/nereids/parser/LogicalPlanBuilderForEncryption.java#L90
   
   https://github.com/apache/doris/blob/a8c890545ecb86fcf0516e4ff6b7c53f2635aed0/fe/fe-core/src/main/java/org/apache/doris/nereids/parser/LogicalPlanBuilderForEncryption.java#L83
   
   And verified by 
   https://github.com/apache/doris/blob/a8c890545ecb86fcf0516e4ff6b7c53f2635aed0/fe/fe-core/src/test/java/org/apache/doris/nereids/parser/EncryptSQLTest.java#L266
   
   But same problem still exists for CREATE USER and ALTER USER commands
   
   <img width="972" height="222" alt="Image" src="https://github.com/user-attachments/assets/7f94afa7-8871-467a-8e45-1eb24a74fae0" />
   
   ### Solution
   
   I'll introduce the similar logic to prevent disclosure of user passwords with CREATE_USER and ALTER_USER commands.
   
   1. introduce necessary change to NereidsParser.g4
   2. override corresponding methods in LogicalPlanBuilderForEncryption 
   3. add required tests in EncryptSQLTest
   
   ### Are you willing to submit PR?
   
   - [x] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org

Re: [I] [Enhancement] (nereids) improve masking of users' password for ALTER USER and CREATE USER in audit logs [doris]

Posted by "morningman (via GitHub)" <gi...@apache.org>.
morningman closed issue #62140: [Enhancement] (nereids) improve masking of users' password for ALTER USER and CREATE USER in audit logs
URL: https://github.com/apache/doris/issues/62140


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org