config(ticdc): mask more security query parameter (#9832)

close #9831
pingcap · Oct 7, 2023 · 4e8db94 · 4e8db94
1 parent a68282d
commit 4e8db94
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 9 deletions.
diff --git a/pkg/util/uri.go b/pkg/util/uri.go
@@ -83,14 +83,16 @@ func MaskSinkURI(uri string) (string, error) {
 
 var sensitiveQueryParameterNames = []string{
 	"password",
-	"sasl-password",
-	"access-key",
-	"secret-access-key",
-	"access_token",
-	"token",
-	"secret",
 	"passwd",
 	"pwd",
+	"access",
+	"token",
+	"secret",
+	"key",
+	"signature",
+	"credential",
+	"private",
+	"client",
 }
 
 // MaskSensitiveDataInURI returns an uri that sensitive infos has been masked.
@@ -101,9 +103,12 @@ func MaskSensitiveDataInURI(uri string) string {
 		return ""
 	}
 	queries := uriParsed.Query()
-	for _, secretKey := range sensitiveQueryParameterNames {
-		if queries.Has(secretKey) {
-			queries.Set(secretKey, "xxxxx")
+	for key := range queries {
+		lower := strings.ToLower(key)
+		for _, secretKey := range sensitiveQueryParameterNames {
+			if strings.Contains(lower, secretKey) {
+				queries.Set(key, "xxxxx")
+			}
 		}
 	}
 	uriParsed.RawQuery = queries.Encode()

diff --git a/pkg/util/uri_test.go b/pkg/util/uri_test.go
@@ -98,6 +98,18 @@ func TestMaskSensitiveDataInURI(t *testing.T) {
 			"mysql://root:[email protected]:3306/?time-zone=c",
 			"mysql://root:[email protected]:3306/?time-zone=c",
 		},
+		{
+			"mysql://root:[email protected]:3306/?access_key=c",
+			"mysql://root:[email protected]:3306/?access_key=xxxxx",
+		},
+		{
+			"mysql://root:[email protected]:3306/?secret_access_key=c",
+			"mysql://root:[email protected]:3306/?secret_access_key=xxxxx",
+		},
+		{
+			"mysql://root:[email protected]:3306/?client_secret=c",
+			"mysql://root:[email protected]:3306/?client_secret=xxxxx",
+		},
 		{
 			"",
 			"",