[FLINK-9100] Shadow/Hide password from configuration that is logged to log file

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 1.5.0
• Component/s: Runtime / Configuration
• Assignee: Sihua Zhou
• Reporter: Szymon Szczypiński
• Created: 27/Mar/18 21:55
• Updated: 04/Sep/19 12:07
• Resolved: 25/Apr/18 07:37

Description

I was thinking to add small improvement to Flink. I want to add feature that will hide value for key containing phrase "password". I want to this only when value is logged to log file.

I want to this because of security reason, if someone need to monitor log file then value from password key will be visible in that monitoring.

I want to change class "GlobalConfiguration" and "SecurityOptions"

In class "GlobalConfiguration" change line

LOG.info("Loading configuration property: {}, {}", key, value);

and add code that will check that if key contain phrase "password" than value will be changed to for example "*******".

The change of value i want to make when new key in class "SecurityOptions" will be set to true. This new key will identifies than password should be shadowed/hidden.

What you thing about that improvement?

This improvement is similar to FLINK-8793 for REST component.
 

 

Issue Links

• is duplicated by: FLINK-9111 SSL Passwords written to log file in plain text
• is related to: FLINK-13957 Log dynamic properties on job submission
• links to: GitHub Pull Request #5854