(doris) branch master updated: [fix](fe) Mask sensitive headers in stream load logs (#62108)

[ga...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

gavinchou pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git


The following commit(s) were added to refs/heads/master by this push:
     new 4c421c0ae6f [fix](fe) Mask sensitive headers in stream load logs (#62108)
4c421c0ae6f is described below

commit 4c421c0ae6f95bc2e180117901d03d5f5309e675
Author: Xin Liao <li...@selectdb.com>
AuthorDate: Fri Apr 17 18:06:55 2026 +0800

    [fix](fe) Mask sensitive headers in stream load logs (#62108)
    
    FE stream load REST logs printed full request headers, which could leak Authorization and token values into INFO logs.
    
    Changes:
    - Mask values for a small set of sensitive headers (e.g., Authorization, token) in getAllHeaders()
    - Add isSensitiveHeader() helper to centralize the masking decision
---
 .../org/apache/doris/httpv2/rest/LoadAction.java   | 11 ++++-
 .../apache/doris/httpv2/rest/LoadActionTest.java   | 49 ++++++++++++++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/LoadAction.java b/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/LoadAction.java
index bcc917ad012..bea379f4f28 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/LoadAction.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/LoadAction.java
@@ -671,12 +671,21 @@ public class LoadAction extends RestBaseController {
         Enumeration<String> headerNames = request.getHeaderNames();
         while (headerNames.hasMoreElements()) {
             String headerName = headerNames.nextElement();
-            String headerValue = request.getHeader(headerName);
+            String headerValue = isSensitiveHeader(headerName) ? "***MASKED***" : request.getHeader(headerName);
             headers.append(headerName).append(":").append(headerValue).append(", ");
         }
         return headers.toString();
     }
 
+    private boolean isSensitiveHeader(String headerName) {
+        return "Authorization".equalsIgnoreCase(headerName)
+                || "Proxy-Authorization".equalsIgnoreCase(headerName)
+                || "Cookie".equalsIgnoreCase(headerName)
+                || "Set-Cookie".equalsIgnoreCase(headerName)
+                || "token".equalsIgnoreCase(headerName)
+                || "Auth-Token".equalsIgnoreCase(headerName);
+    }
+
     private Backend selectBackendForGroupCommit(String clusterName, HttpServletRequest req, long tableId)
             throws LoadException {
         ConnectContext ctx = new ConnectContext();
diff --git a/fe/fe-core/src/test/java/org/apache/doris/httpv2/rest/LoadActionTest.java b/fe/fe-core/src/test/java/org/apache/doris/httpv2/rest/LoadActionTest.java
new file mode 100644
index 00000000000..28d7cda587c
--- /dev/null
+++ b/fe/fe-core/src/test/java/org/apache/doris/httpv2/rest/LoadActionTest.java
@@ -0,0 +1,49 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.doris.httpv2.rest;
+
+import jakarta.servlet.http.HttpServletRequest;
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+
+import java.lang.reflect.Method;
+import java.util.Arrays;
+import java.util.Collections;
+
+public class LoadActionTest {
+
+    @Test
+    public void testGetAllHeadersMasksSensitiveHeaders() throws Exception {
+        LoadAction action = new LoadAction();
+        HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+        Mockito.when(request.getHeaderNames()).thenReturn(Collections.enumeration(Arrays.asList(
+                "Authorization", "Cookie", "Set-Cookie", "token", "label")));
+        Mockito.when(request.getHeader("label")).thenReturn("load_label");
+
+        Method method = LoadAction.class.getDeclaredMethod("getAllHeaders", HttpServletRequest.class);
+        method.setAccessible(true);
+        String headers = (String) method.invoke(action, request);
+
+        Assert.assertTrue(headers.contains("Authorization:***MASKED***"));
+        Assert.assertTrue(headers.contains("Cookie:***MASKED***"));
+        Assert.assertTrue(headers.contains("Set-Cookie:***MASKED***"));
+        Assert.assertTrue(headers.contains("token:***MASKED***"));
+        Assert.assertTrue(headers.contains("label:load_label"));
+    }
+}


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org