Thanks for the patch!
Is it OK to expose the length of the original value? Wondering if the replacement value should be a constant number of asterisks or something like "<redacted>" or "<removed>".
These properties are still visible via the AM UI while the job is running. Should they be redacted there as well?
This should be making a copy of the configuration rather than doctoring it up directly with redacted values, tracking them in a separate map, then trying to patch it back later. If anything is asynchronously looking at the config and needs one of those redacted values then we're setting ourselves up for a random failure that's difficult to debug. Making a copy means we don't need to worry about tracking values and restoring anything later.
There should be an entry in mapred-default.xml with an appropriate description documenting the new property.
I recommend we drop the '-in-jhs' part of the property name since it's likely users will want this redacted everywhere eventually, even if it's not complete in this patch.