Skip to content

[fix](lakesoul) Avoid logging credentials on branch-3.1 - #69533

Closed
OIiveirra wants to merge 1 commit into
apache:branch-3.1from
OIiveirra:fix/jira-sdbsec-293
Closed

[fix](lakesoul) Avoid logging credentials on branch-3.1#69533
OIiveirra wants to merge 1 commit into
apache:branch-3.1from
OIiveirra:fix/jira-sdbsec-293

Conversation

@OIiveirra

@OIiveirra OIiveirra commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

What problem does this PR solve?

Issue Number: N/A (no public GitHub issue)

Related PR: #69473

Problem Summary:

Port the LakeSoul diagnostic logging fix to branch-3.1. The retained scanner logs complete parameters at INFO, including object storage credentials carried in options. The FE scan node also logs complete catalog properties at DEBUG.

Log only the query ID and batch size when opening the scanner, and remove the catalog-property dump. Authentication options continue to reach the reader unchanged.

Add the same focused unit regressions and an explicit lakesoul-scanner-tests Maven profile. The deprecated scanner remains excluded from default builds, and normal LakeSoul catalog creation remains disabled.

Release note

Prevent sensitive LakeSoul scanner parameters and catalog properties from being written to logs.

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:

    Validation on branch-3.1 with JDK 17 and a matching Thrift 0.16.0 generator:

    • LakeSoulJniScannerTest: 3 tests passed, covering INFO, DEBUG, and a missing query ID; credentials still reach the native reader.
    • LakeSoulScanNodeTest: 1 test passed, verifying credentials stay in scan options and out of DEBUG logs.
    • All 4 tests fail on credential-leak assertions with the original 3.1 production logging, and pass with this fix. Fresh Surefire XML reports show no skipped tests or errors.
    • Targeted Checkstyle: 0 violations. git diff --check passed.

    Native I/O is isolated with Mockito. No live LakeSoul SQL scan was run; the branch rejects LakeSoul catalog creation.

  • Behavior changed:

    • No.
    • Yes. Scanner startup logs contain the query ID and batch size instead of the full parameters; FE no longer logs complete catalog properties.

  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@OIiveirra
[fix](lakesoul) Avoid logging object storage credentials
240974c 
Port the diagnostic logging fix from apache#69473 to branch-3.1. Replace the
complete scanner parameter dump with query ID and batch size, and remove
the FE catalog-property dump. Preserve authentication options.

Include log-capture regressions and an opt-in test profile for the retained
scanner without enabling LakeSoul in default builds.
@OIiveirra
OIiveirra requested a review from morrySnow as a code owner October 23, 2026 10:33
Copilot AI balanced review requested due to automatic review settings October 23, 2026 10:33
@hello-stephen

hello-stephen commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

Copilot AI reviewed Oct 23, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@OIiveirra

OIiveirra commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator Author

run buildall

@OIiveirra

OIiveirra commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator Author

/review

@github-actions

github-actions Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Codex automated review failed and did not complete.

Error: Review recovery stopped: No final review submission was declared
Workflow run: https://github.com/apache/doris/actions/runs/39940102074

Please inspect the workflow logs and rerun the review after the underlying issue is resolved.

@OIiveirra

OIiveirra commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator Author

/review

@github-actions

github-actions Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Codex automated review failed and did not complete.

Error: Review recovery stopped: No final review submission was declared
Workflow run: https://github.com/apache/doris/actions/runs/39940622722

Please inspect the workflow logs and rerun the review after the underlying issue is resolved.

@OIiveirra

OIiveirra commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator Author

/review

@github-actions

github-actions Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Codex automated review failed and did not complete.

Error: Review recovery stopped: No final review submission was declared
Workflow run: https://github.com/apache/doris/actions/runs/39941760878

Please inspect the workflow logs and rerun the review after the underlying issue is resolved.

@OIiveirra

OIiveirra commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator Author

/review

@github-actions

github-actions Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Codex automated review failed and did not complete.

Error: Review recovery stopped: No final review submission was declared
Workflow run: https://github.com/apache/doris/actions/runs/39943892509

Please inspect the workflow logs and rerun the review after the underlying issue is resolved.

@OIiveirra OIiveirra closed this Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@morrySnow morrySnow Awaiting requested review from morrySnow morrySnow is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@OIiveirra @hello-stephen