apache / apache/druid

Lookup should not log sensitive information when failing to parse

Open
#15,061 0 comments 0 reactions 0 assignees View on GitHub
Area - Lookups Security
Dominant language
Java
Stars
14.1k
Forks
3.8k
Avg merge
2d 58m
Merged PRs (30d)
233

Description

### Affected Version

27.0.0

### Description

When using globally cached lookups but the extension "druid-lookups-cached-global" is not enabled, druid historical services (and potentially other services using lookups) will log the full connector configuration including uri, user, and password in plaintext.

```
2023-09-29T19:14:40,084 WARN [main] org.apache.druid.query.lookup.LookupUtils - Lookup [my-lookup] could not be serialized properly. Please check its configuration. Error: Could not resolve type id 'cachedNamespace' as a subtype of `org.apache.druid.query.lookup.LookupExtractorFactory`: known type ids = [map] (for POJO property 'lookupExtractorFactory')
at [Source: (byte[])"{"version":"lookup_version_to_replace","lookupExtractorFactory":{"type":"cachedNamespace","extractionNamespace":{"valueColumn":"XXX","table":"XXX","keyColumn":"XXX","connectorConfig":{"connectURI":"XXX","user":"XXX","password":"XXX"},"pollPeriod":"PT30S","type":"jdbc"}}}"; line: 1, column: 73] (through reference chain: org.apache.druid.query.lookup.LookupExtractorFactoryContainer["lookupExtractorFactory"])
```

Contributor guide

Open the contributing guide

Research direction

Start at org.apache.druid.query.lookup.LookupUtils and reproduce the warning using the globally cached lookup configuration shown in the report. Trace how the failed parse builds the warning and verify that connector details such as the URI, user, and password are no longer logged while the parsing failure remains diagnosable.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.