[jira] [Resolved] (SPARK-30263) Don't log values of ignored non-Spark properties

["Dongjoon Hyun (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SPARK-30263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Dongjoon Hyun resolved SPARK-30263.
-----------------------------------
    Fix Version/s: 3.0.0
                   2.4.5
       Resolution: Fixed

Issue resolved by pull request 26893
[https://github.com/apache/spark/pull/26893]

> Don't log values of ignored non-Spark properties
> ------------------------------------------------
>
>                 Key: SPARK-30263
>                 URL: https://issues.apache.org/jira/browse/SPARK-30263
>             Project: Spark
>          Issue Type: Bug
>          Components: Spark Core
>    Affects Versions: 2.4.4, 3.0.0
>            Reporter: Sean R. Owen
>            Assignee: Sean R. Owen
>            Priority: Minor
>             Fix For: 2.4.5, 3.0.0
>
>
> Comment per Aaron Steers:
> Is it expected that this error would print aws security keys to log files? Seems like a serious security concern.
> {code}
> Warning: Ignoring non-spark config property: fs.s3a.access.key={full-access-key}
> Warning: Ignoring non-spark config property: fs.s3a.secret.key={full-secret-key}
> {code}
> Could we not accomplish the same thing by printing the name of the key without the key's value?
> I think we can also redact these, but, also no big reason to log the value of ignored properties here anyway.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org