8000 fix: mask the aws credential info by yanghua · Pull Request #364 · apache/arrow-rs-object-store · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

fix: mask the aws credential info #364

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
May 16, 2025
Merged

fix: mask the aws credential info #364

merged 2 commits into from
May 16, 2025

Conversation

yanghua
Copy link
Contributor
@yanghua yanghua commented May 15, 2025 •
edited
Loading

Which issue does this PR close?

Closes #363.

Rationale for this change

Currently, AwsCredential supports #[derive(Debug)], as a default behavior, it would print the credential's plaintext. Like this:

[2025-05-13T07:40:10Z DEBUG lance::dataset::scanner] Execution plan:
ProjectionExec { input: TakeExec { dataset: Dataset { object_store: ObjectStore { inner: AmazonS3 { client: S3Client { config: S3Config { region: "cn-beijing", endpoint: Some("[https://xxx.s3-cn-beijing.volces.com/](https://xxx.s3-cn-beijing.volces.com)"), bucket: "xxx", bucket_endpoint: "[https://xxx.-s3-cn-beijing.volces.com/](https://xxx.-s3-cn-beijing.volces.com)", credentials: StaticCredentialProvider { credential: AwsCredential { key_id: "xxx", secret_key: "xxx==", token: None } }, session_provider: None, retry_config: RetryConfig { backoff: BackoffConfig { init_backoff: 100ms, max_backoff: 15s, base: 2.0 }, max_retries: 10, retry_timeout: 180s }, client_options: ClientOptions { user_agent: None, content_type_map: {}, default_content_type: None, default_headers: None, proxy_url: None, proxy_ca_certificate: None, proxy_excludes: None, allow_http: Parsed(false), allow_insecure: Parsed(false), timeout: Some(Parsed(30s)), connect_timeout: Some(Parsed(5s)), pool_idle_timeout: None, pool_max_idle_per_host: None, http2_keep_alive_interval: None, http2_keep_alive_timeout: None, http2_keep_alive_while_idle: Parsed(false), http1_only: Parsed(true), http2_only: Parsed(false) }, sign_payload: true, skip_signature: false, disable_tagging: false, checksum: None, copy_if_not_exists: None, conditional_put: None, encryption_headers: S3EncryptionHeaders({}) }

For security reasons, it would be better to mask the credentials. If someone wants to show them, let it print manually.

What changes are included in this PR?

Customize the std::fmt::Debug for AwsCredential to override the default behavior.

Are there any user-facing changes?

NO

tustvold
tustvold reviewed May 15, 2025
View reviewed changes
src/aws/credential.rs Outdated
impl std::fmt::Debug for AwsCredential {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
f.debug_struct("AwsCredential")
.field("key_id", &"******")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't secret and is safe to print

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tustvold reasonable, let's only mask secret_key and token .

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tustvold Updated.

@tustvold tustvold merged commit 55dab67 into apache:main May 16, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tustvold tustvold tustvold left review comments

@rtyler rtyler rtyler approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Security: AwsCredential prints plaintext may cause security issue.
3 participants
@yanghua @rtyler @tustvold
0