You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by "wankai123 (via GitHub)" <gi...@apache.org> on 2026/03/05 06:13:08 UTC
[PR] Fix `/debugging/config/dump` may leak sensitive information if there are second level properties in the configuration. [skywalking]
wankai123 opened a new pull request, #13726:
URL: https://github.com/apache/skywalking/pull/13726
- [ ] If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #<issue number>.
- [X] Update the [`CHANGES` log](https://github.com/apache/skywalking/blob/master/docs/en/changes/changes.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix `/debugging/config/dump` may leak sensitive information if there are second level properties in the configuration. [skywalking]
Posted by "wankai123 (via GitHub)" <gi...@apache.org>.
wankai123 commented on code in PR #13726:
URL: https://github.com/apache/skywalking/pull/13726#discussion_r2888592243
##########
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/status/ServerStatusService.java:
##########
@@ -100,19 +101,43 @@ public ConfigList dumpBootingConfigurations(String keywords4MaskingSecretsOfConf
(providerName, providerConfiguration) ->
providerConfiguration.getProperties().forEach(
(key, value) -> {
- for (final String keyword : keywords) {
- if (key.toString().toLowerCase().contains(keyword.toLowerCase())) {
- value = "******";
- }
+ if (value instanceof Properties) {
+ Properties properties = (Properties) value;
+ properties.forEach((k, v) -> {
+ String configKey = moduleName + "." + providerName + "." + key + "." + k;
+ String configValue = maskConfigValue(configKey, v.toString(), keywords);
+ configList.put(configKey, configValue);
+ });
+ } else {
+ String configKey = moduleName + "." + providerName + "." + key;
+ String configValue = maskConfigValue(key.toString(), value.toString(), keywords);
Review Comment:
updated 108 to `k.toString()`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix `/debugging/config/dump` may leak sensitive information if there are second level properties in the configuration. [skywalking]
Posted by "wankai123 (via GitHub)" <gi...@apache.org>.
wankai123 commented on code in PR #13726:
URL: https://github.com/apache/skywalking/pull/13726#discussion_r2888593950
##########
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/status/ServerStatusService.java:
##########
@@ -100,19 +101,43 @@ public ConfigList dumpBootingConfigurations(String keywords4MaskingSecretsOfConf
(providerName, providerConfiguration) ->
providerConfiguration.getProperties().forEach(
(key, value) -> {
- for (final String keyword : keywords) {
- if (key.toString().toLowerCase().contains(keyword.toLowerCase())) {
- value = "******";
- }
+ if (value instanceof Properties) {
+ Properties properties = (Properties) value;
+ properties.forEach((k, v) -> {
+ String configKey = moduleName + "." + providerName + "." + key + "." + k;
+ String configValue = maskConfigValue(configKey, v.toString(), keywords);
+ configList.put(configKey, configValue);
+ });
+ } else {
+ String configKey = moduleName + "." + providerName + "." + key;
+ String configValue = maskConfigValue(key.toString(), value.toString(), keywords);
+ configList.put(configKey, configValue);
}
- configList.put(moduleName + "." + providerName + "." + key, value.toString());
}
)
);
}
return configList;
}
+ /**
+ * Mask the configuration value if the key contains any masking keyword.
+ *
+ * @param configKey the configuration key to check
+ * @param configValue the configuration value to mask
+ * @param keywords the keywords for masking secrets
+ * @return masked value "******" if key matches any keyword, otherwise return the original value
+ */
+ private String maskConfigValue(String configKey, String configValue, String[] keywords) {
+ String lowerConfigKey = configKey.toLowerCase();
+ for (String keyword : keywords) {
+ if (lowerConfigKey.contains(keyword.toLowerCase())) {
+ return "******";
+ }
+ }
+ return configValue;
+ }
Review Comment:
added e2e
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix `/debugging/config/dump` may leak sensitive information if there are second level properties in the configuration. [skywalking]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13726:
URL: https://github.com/apache/skywalking/pull/13726#discussion_r2887867279
##########
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/status/ServerStatusService.java:
##########
@@ -100,19 +101,43 @@ public ConfigList dumpBootingConfigurations(String keywords4MaskingSecretsOfConf
(providerName, providerConfiguration) ->
providerConfiguration.getProperties().forEach(
(key, value) -> {
- for (final String keyword : keywords) {
- if (key.toString().toLowerCase().contains(keyword.toLowerCase())) {
- value = "******";
- }
+ if (value instanceof Properties) {
+ Properties properties = (Properties) value;
+ properties.forEach((k, v) -> {
+ String configKey = moduleName + "." + providerName + "." + key + "." + k;
+ String configValue = maskConfigValue(configKey, v.toString(), keywords);
+ configList.put(configKey, configValue);
+ });
+ } else {
+ String configKey = moduleName + "." + providerName + "." + key;
+ String configValue = maskConfigValue(key.toString(), value.toString(), keywords);
+ configList.put(configKey, configValue);
}
- configList.put(moduleName + "." + providerName + "." + key, value.toString());
}
)
);
}
return configList;
}
+ /**
+ * Mask the configuration value if the key contains any masking keyword.
+ *
+ * @param configKey the configuration key to check
+ * @param configValue the configuration value to mask
+ * @param keywords the keywords for masking secrets
+ * @return masked value "******" if key matches any keyword, otherwise return the original value
+ */
+ private String maskConfigValue(String configKey, String configValue, String[] keywords) {
+ String lowerConfigKey = configKey.toLowerCase();
+ for (String keyword : keywords) {
+ if (lowerConfigKey.contains(keyword.toLowerCase())) {
+ return "******";
+ }
+ }
+ return configValue;
+ }
Review Comment:
This new logic for handling nested `Properties` and masking sensitive values lacks unit test coverage. Other classes in `server-core` have corresponding tests (e.g., `SearchableTracesTagsWatcherTest`, `ComponentLibraryCatalogFileTest`). Please consider adding a test for `dumpBootingConfigurations` that covers: (1) masking of non-nested config values, (2) masking of nested `Properties` values, and (3) ensuring non-sensitive values are not masked.
##########
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/status/ServerStatusService.java:
##########
@@ -100,19 +101,43 @@ public ConfigList dumpBootingConfigurations(String keywords4MaskingSecretsOfConf
(providerName, providerConfiguration) ->
providerConfiguration.getProperties().forEach(
(key, value) -> {
- for (final String keyword : keywords) {
- if (key.toString().toLowerCase().contains(keyword.toLowerCase())) {
- value = "******";
- }
+ if (value instanceof Properties) {
+ Properties properties = (Properties) value;
+ properties.forEach((k, v) -> {
+ String configKey = moduleName + "." + providerName + "." + key + "." + k;
+ String configValue = maskConfigValue(configKey, v.toString(), keywords);
+ configList.put(configKey, configValue);
+ });
+ } else {
+ String configKey = moduleName + "." + providerName + "." + key;
+ String configValue = maskConfigValue(key.toString(), value.toString(), keywords);
Review Comment:
Bug: Inconsistent key passed to `maskConfigValue` between the nested and non-nested branches.
For nested `Properties` (line 108), you pass the full `configKey` (`moduleName + "." + providerName + "." + key + "." + k`) to `maskConfigValue`. But for non-nested values (line 113), you pass only `key.toString()` instead of the already-computed `configKey` (`moduleName + "." + providerName + "." + key`).
This means the masking check behaves differently for the two branches. While the original code also only checked against `key`, the refactored nested branch now checks against the full path — so these should be consistent. Please pass `configKey` instead of `key.toString()` on line 113 to match the behavior of the nested case on line 108.
```suggestion
String configValue = maskConfigValue(configKey, value.toString(), keywords);
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix `/debugging/config/dump` may leak sensitive information if there are second level properties in the configuration. [skywalking]
Posted by "wankai123 (via GitHub)" <gi...@apache.org>.
wankai123 commented on code in PR #13726:
URL: https://github.com/apache/skywalking/pull/13726#discussion_r2888593950
##########
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/status/ServerStatusService.java:
##########
@@ -100,19 +101,43 @@ public ConfigList dumpBootingConfigurations(String keywords4MaskingSecretsOfConf
(providerName, providerConfiguration) ->
providerConfiguration.getProperties().forEach(
(key, value) -> {
- for (final String keyword : keywords) {
- if (key.toString().toLowerCase().contains(keyword.toLowerCase())) {
- value = "******";
- }
+ if (value instanceof Properties) {
+ Properties properties = (Properties) value;
+ properties.forEach((k, v) -> {
+ String configKey = moduleName + "." + providerName + "." + key + "." + k;
+ String configValue = maskConfigValue(configKey, v.toString(), keywords);
+ configList.put(configKey, configValue);
+ });
+ } else {
+ String configKey = moduleName + "." + providerName + "." + key;
+ String configValue = maskConfigValue(key.toString(), value.toString(), keywords);
+ configList.put(configKey, configValue);
}
- configList.put(moduleName + "." + providerName + "." + key, value.toString());
}
)
);
}
return configList;
}
+ /**
+ * Mask the configuration value if the key contains any masking keyword.
+ *
+ * @param configKey the configuration key to check
+ * @param configValue the configuration value to mask
+ * @param keywords the keywords for masking secrets
+ * @return masked value "******" if key matches any keyword, otherwise return the original value
+ */
+ private String maskConfigValue(String configKey, String configValue, String[] keywords) {
+ String lowerConfigKey = configKey.toLowerCase();
+ for (String keyword : keywords) {
+ if (lowerConfigKey.contains(keyword.toLowerCase())) {
+ return "******";
+ }
+ }
+ return configValue;
+ }
Review Comment:
added test in mysql e2e
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix `/debugging/config/dump` may leak sensitive information if there are second level properties in the configuration. [skywalking]
Posted by "wu-sheng (via GitHub)" <gi...@apache.org>.
wu-sheng merged PR #13726:
URL: https://github.com/apache/skywalking/pull/13726
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org