pingcap / pingcap/tidb

Add Log Lint Test to Prevent Data Value Leakage in TiDB Logs When Log Redaction is Enabled

Open
#59,697 0 comments 0 reactions 0 assignees View on GitHub
type/enhancement
Dominant language
Go
Stars
40.5k
Forks
6.2k
PR merge metrics
PR metrics pending

Description

## Enhancement

Description:
When log.redaction-enabled is set to true, TiDB should ensure that sensitive user data is not logged. However, there is currently no automated test to enforce this guarantee and detect accidental data leakage in logs. To improve security and compliance, I propose adding a log lint test to validate that TiDB logs do not contain raw data values when log redaction is enabled.

Related Issue:

[#59279](https://github.com/pingcap/tidb/issues/59279) - Existing discussion on potential log data leakage.

Proposal:

1. Develop a log lint test as part of TiDB’s CI/CD pipeline to scan logs when log.redaction-enabled=true.
2. Define a rule set to detect sensitive data patterns (e.g., SQL literals, raw query parameters, user-provided values).
3. Ensure logs comply with redaction expectations by verifying placeholders (?) are used instead of actual values.
4. Fail the test if data leakage is detected, ensuring regressions do not occur in future releases.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.