You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "Yash Mayya (Jira)" <ji...@apache.org> on 2023/08/18 07:14:00 UTC
[jira] [Comment Edited] (KAFKA-15377) GET /connectors/{connector}/tasks-config endpoint exposes externalized secret values
[ https://issues.apache.org/jira/browse/KAFKA-15377?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17755826#comment-17755826 ]
Yash Mayya edited comment on KAFKA-15377 at 8/18/23 7:13 AM:
-------------------------------------------------------------
[~mimaison] [~ChrisEgerton] even though this will technically change the response for a public REST API, I'm not sure it requires a KIP since it should be classified as a bug. What do you folks think?
was (Author: yash.mayya):
[~mimaison] [~ChrisEgerton] even though this does technically change the response for a public REST API, I'm not sure it requires a KIP since it should be classified as a bug. What do you folks think?
> GET /connectors/{connector}/tasks-config endpoint exposes externalized secret values
> ------------------------------------------------------------------------------------
>
> Key: KAFKA-15377
> URL: https://issues.apache.org/jira/browse/KAFKA-15377
> Project: Kafka
> Issue Type: Bug
> Components: KafkaConnect
> Reporter: Yash Mayya
> Assignee: Yash Mayya
> Priority: Major
>
> The {{GET /connectors/\{connector}/tasks-config}} endpoint added in [https://cwiki.apache.org/confluence/display/KAFKA/KIP-661%3A+Expose+task+configurations+in+Connect+REST+API] exposes externalized secret values in task configurations (see [https://cwiki.apache.org/confluence/display/KAFKA/KIP-297%3A+Externalizing+Secrets+for+Connect+Configurations)]. A similar bug was fixed in https://issues.apache.org/jira/browse/KAFKA-5117 / [https://github.com/apache/kafka/pull/6129] for the {{GET /connectors/\{connector}/tasks}} endpoint. The config provider placeholder should be used instead of the resolved config value.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)