(spark) branch branch-4.1 updated: [CORE][MINOR] Expand default redaction regex

[ho...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/spark.git


The following commit(s) were added to refs/heads/branch-4.1 by this push:
     new c2a14b89b693 [CORE][MINOR] Expand default redaction regex
c2a14b89b693 is described below

commit c2a14b89b6931236bf5b1de59dc2f0c620c3691b
Author: Holden Karau <ho...@snowflake.com>
AuthorDate: Tue Sep 1 19:03:37 2026 +0000

    [CORE][MINOR] Expand default redaction regex
    
    Co-authored-by: Cursor <cu...@cursor.com>
    Co-authored-by: Holden Karau <ho...@pigscanfly.ca>
---
 core/src/main/scala/org/apache/spark/internal/config/package.scala     | 2 +-
 core/src/test/scala/org/apache/spark/util/UtilsSuite.scala             | 3 ++-
 docs/configuration.md                                                  | 2 +-
 .../src/main/java/org/apache/spark/launcher/CommandBuilderUtils.java   | 3 ++-
 .../test/java/org/apache/spark/launcher/CommandBuilderUtilsSuite.java  | 2 ++
 5 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/core/src/main/scala/org/apache/spark/internal/config/package.scala b/core/src/main/scala/org/apache/spark/internal/config/package.scala
index 8b32c18aa3b6..dd8847a810e2 100644
--- a/core/src/main/scala/org/apache/spark/internal/config/package.scala
+++ b/core/src/main/scala/org/apache/spark/internal/config/package.scala
@@ -1291,7 +1291,7 @@ package object config {
         "like YARN and event logs.")
       .version("2.1.2")
       .regexConf
-      .createWithDefault("(?i)secret|password|token|access[.]?key".r)
+      .createWithDefault("(?i)secret|password|token|access[.]?key|credential".r)
 
   private[spark] val STRING_REDACTION_PATTERN =
     ConfigBuilder("spark.redaction.string.regex")
diff --git a/core/src/test/scala/org/apache/spark/util/UtilsSuite.scala b/core/src/test/scala/org/apache/spark/util/UtilsSuite.scala
index 61952c401853..4155dc1e9948 100644
--- a/core/src/test/scala/org/apache/spark/util/UtilsSuite.scala
+++ b/core/src/test/scala/org/apache/spark/util/UtilsSuite.scala
@@ -1172,7 +1172,8 @@ class UtilsSuite extends SparkFunSuite with ResetSystemProperties {
       "spark.hadoop.fs.s3.awsAccessKeyId",
       "spark.hadoop.fs.s3a.access.key",
       "spark.my.password",
-      "spark.my.sECreT")
+      "spark.my.sECreT",
+      "spark.sql.catalog.mycatalog.credential")
     secretKeys.foreach { key => sparkConf.set(key, "sensitive_value") }
     // Set a non-secret key
     sparkConf.set("spark.regular.property", "regular_value")
diff --git a/docs/configuration.md b/docs/configuration.md
index c1d3f082e87b..0e3dec84e2ea 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -812,7 +812,7 @@ Apart from these, the following properties are also available, and may be useful
 </tr>
 <tr>
   <td><code>spark.redaction.regex</code></td>
-  <td>(?i)secret|password|token|access[.]?key</td>
+  <td>(?i)secret|password|token|access[.]?key|credential</td>
   <td>
     Regex to decide which Spark configuration properties and environment variables in driver and
     executor environments contain sensitive information. When this regex matches a property key or
diff --git a/launcher/src/main/java/org/apache/spark/launcher/CommandBuilderUtils.java b/launcher/src/main/java/org/apache/spark/launcher/CommandBuilderUtils.java
index 737544383c2f..76459ad3f0b6 100644
--- a/launcher/src/main/java/org/apache/spark/launcher/CommandBuilderUtils.java
+++ b/launcher/src/main/java/org/apache/spark/launcher/CommandBuilderUtils.java
@@ -36,7 +36,8 @@ class CommandBuilderUtils {
   static final String ENV_SPARK_HOME = "SPARK_HOME";
   // This should be consistent with org.apache.spark.internal.config.SECRET_REDACTION_PATTERN
   // We maintain this copy to avoid depending on `core` module.
-  static final String SECRET_REDACTION_PATTERN = "(?i)secret|password|token|access[.]?key";
+  static final String SECRET_REDACTION_PATTERN =
+    "(?i)secret|password|token|access[.]?key|credential";
   static final Pattern redactPattern = Pattern.compile(SECRET_REDACTION_PATTERN);
   static final Pattern keyValuePattern = Pattern.compile("-D(.+?)=(.+)");
 
diff --git a/launcher/src/test/java/org/apache/spark/launcher/CommandBuilderUtilsSuite.java b/launcher/src/test/java/org/apache/spark/launcher/CommandBuilderUtilsSuite.java
index 740d7c57f7a1..ec8c3ca7e4cf 100644
--- a/launcher/src/test/java/org/apache/spark/launcher/CommandBuilderUtilsSuite.java
+++ b/launcher/src/test/java/org/apache/spark/launcher/CommandBuilderUtilsSuite.java
@@ -74,6 +74,8 @@ public class CommandBuilderUtilsSuite {
     assertEquals(redact("-Dk=v"), "-Dk=v");
     assertEquals(redact("-Dk=secret"), "-Dk=secret");
     assertEquals(redact("-DsecretKey=my-secret"), "-DsecretKey=*********(redacted)");
+    assertEquals(redact("-Dspark.sql.catalog.foo.credential=my-credential"),
+      "-Dspark.sql.catalog.foo.credential=*********(redacted)");
     assertEquals(redactCommandLineArgs(Arrays.asList("-DsecretKey=my-secret")),
       Arrays.asList("-DsecretKey=*********(redacted)"));
   }


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org