You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@pekko.apache.org by "pjfanning (via GitHub)" <gi...@apache.org> on 2026/08/03 16:42:52 UTC
[PR] mask sensitive values in toString [pekko-connectors]
pjfanning opened a new pull request, #1809:
URL: https://github.com/apache/pekko-connectors/pull/1809
This commit updates 11 files across multiple connector modules to mask sensitive credentials and tokens when converting objects to their string representation. The change prevents accidental exposure of secrets (API keys, tokens, passwords) in logs or debug output.
Modules affected:
- AMQP — AmqpConnectionProvider
- Google (common) — AccessToken, AccessTokenCredentials, ServiceAccountCredentials, UserAccessCredentials
- Huawei Push Kit — HmsSettings, HmsTokenApi
- IronMQ — IronMqSettings
- Jakarta Messaging — Credentials
- JMS — Credentials
- AWS S3 — model
Each file had 1–13 lines added to replace sensitive field values with masked placeholders (e.g., "***") in toString methods.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org
Re: [PR] mask sensitive values in toString [pekko-connectors]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #1809:
URL: https://github.com/apache/pekko-connectors/pull/1809#issuecomment-5189750805
> I'm in favour of this change, but it does beg the question: do we now _guarantee_ that _all_ sensitive values are masked in (for example) log output?
>
> I think we do/should not, and should make that explicit. WDYT?
I'm not sure how we can achieve this and for avoidance of security reviewers, I think we should avoid making any explicit guarantees.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org
Re: [PR] mask sensitive values in toString [pekko-connectors]
Posted by "He-Pin (via GitHub)" <gi...@apache.org>.
He-Pin commented on code in PR #1809:
URL: https://github.com/apache/pekko-connectors/pull/1809#discussion_r3713819498
##########
jms/src/main/scala/org/apache/pekko/stream/connectors/jms/Credentials.scala:
##########
@@ -31,7 +31,7 @@ final class Credentials private (
override def toString =
"Credentials(" +
s"username=$username," +
- s"password=${"*" * password.length}" +
+ s"password=*****" +
Review Comment:
Make this configurable? and I think it was better
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org
Re: [PR] mask sensitive values in toString [pekko-connectors]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning merged PR #1809:
URL: https://github.com/apache/pekko-connectors/pull/1809
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org
Re: [PR] mask sensitive values in toString [pekko-connectors]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on code in PR #1809:
URL: https://github.com/apache/pekko-connectors/pull/1809#discussion_r3714866262
##########
jms/src/main/scala/org/apache/pekko/stream/connectors/jms/Credentials.scala:
##########
@@ -31,7 +31,7 @@ final class Credentials private (
override def toString =
"Credentials(" +
s"username=$username," +
- s"password=${"*" * password.length}" +
+ s"password=*****" +
Review Comment:
giving away the length of the password is regarded as bad practice - I think hardcoding it as 5 * is ok
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org
Re: [PR] mask sensitive values in toString [pekko-connectors]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #1809:
URL: https://github.com/apache/pekko-connectors/pull/1809#issuecomment-5189984625
> > I'm in favour of this change, but it does beg the question: do we now _guarantee_ that _all_ sensitive values are masked in (for example) log output?
> > I think we do/should not, and should make that explicit. WDYT?
>
> I'm not sure how we can achieve this and for avoidance of security reviewers, I think we should avoid making any explicit guarantees.
That means we're in agreement, right? I meant making explicit that we _don't_ guarantee sensitive values are masked in (for example) log output
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org