Uh oh!
There was an error while loading. Please reload this page.
[fix](data security) Mask ai.api_key in CREATE/ALTER RESOURCE logs - #66006
Conversation
hello-stephen
commented
Jul 24, 2026
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
wenzhenghu
commented
Jul 24, 2026
run buildall |
hello-stephen
commented
Jul 24, 2026
TPC-H: Total hot run time: 23121 ms |
hello-stephen
commented
Jul 24, 2026
TPC-DS: Total hot run time: 117368 ms |
hello-stephen
commented
Jul 24, 2026
ClickBench: Total hot run time: 18.25 s |
hello-stephen
commented
Jul 24, 2026
FE UT Coverage ReportIncrement line coverage |
PR approved by at least one committer and no changes requested. |
PR approved by anyone and no changes requested. |
wenzhenghu
commented
Jul 24, 2026
run buildall |
wenzhenghu
commented
Jul 24, 2026
run buildall |
wenzhenghu
commented
Jul 24, 2026
Note on commit |
hello-stephen
commented
Jul 24, 2026
TPC-H: Total hot run time: 29175 ms |
hello-stephen
commented
Jul 24, 2026
TPC-DS: Total hot run time: 177857 ms |
hello-stephen
commented
Jul 24, 2026
ClickBench: Total hot run time: 25.1 s |
hello-stephen
commented
Jul 24, 2026
FE UT Coverage ReportIncrement line coverage |
PR approved by at least one committer and no changes requested. |
There was a problem hiding this comment.
Request changes. The direct CREATE/ALTER AI-resource property masking, case-insensitive ai.api_key registration, and ResourceMgr name/type-only success log are sound, but the PR does not yet prevent credentials from reaching FE logs and it introduces a logging-dependent command failure.
Critical checkpoints:
- Functional correctness and goal coverage: incomplete. Seven inline findings cover forwarded DEBUG leakage, fail-open pre-execution logging, skipped scheduled DML, later raw query/retry logs, omitted outer/target job properties, masking exceptions that change execution, and order-dependent runtime tests.
- Parallel and error paths: raw/forwarded construction, command/planner failures, query handling, and retries were traced; these are the main production gaps.
- Lifecycle, concurrency, and persistence: no new runtime lock-order, edit-log, replay, transaction, or data-visibility issue was found. The changed
ResourceMgrpersistence ordering is unchanged; the JUnitPER_CLASSlifecycle does create a separate test-isolation defect. - Configuration, compatibility, and performance: no new FE-BE protocol, storage format, configuration contract, or compatibility issue was found. One INFO disclosure is gated by
enable_print_request_before_execution; no separate performance blocker was substantiated. - Tests and results: no local builds or tests were run because the review contract prohibits them. At submission time, CheckStyle, compile, FE UT, and regression checks pass;
check_coverage_fefails andcode-reviewis pending. The changed tests do not cover the material parallel paths and have shared-resource state. - Security model: this is assessed as correctness of the PR's operational credential-masking goal, without making a separate vulnerability-classification claim.
User focus: no additional focus points were supplied, so the full PR was reviewed without an extra focus-specific issue.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
wenzhenghu
commented
Jul 27, 2026
run buildall |
hello-stephen
commented
Jul 27, 2026
FE UT Coverage ReportIncrement line coverage |
yiguolei
commented
Aug 5, 2026
skip performance |
PR approved by at least one committer and no changes requested. |
Uh oh!
There was an error while loading. Please reload this page.
…pache#66006) ### What problem does this PR solve? Issue Number: None Related PR: None Problem Summary: This PR is scoped only to fixing plaintext leakage of `ai.api_key` in `CREATE RESOURCE` and `ALTER RESOURCE` statements. Before this change, `ai.api_key` could appear in FE runtime logs and audit logs when these resource statements were logged in their original form. This PR limits the fix to masking `ai.api_key` for `CREATE/ALTER RESOURCE` logging paths only. It does not intend to expand masking coverage for other statement types or other logging paths in this PR. ### Release note Mask `ai.api_key` in FE logs and audit logs for `CREATE/ALTER RESOURCE` statements. ### Check List (For Author) - Test: - Unit Test - Manual test - Behavior changed: - Yes. `ai.api_key` is no longer logged in plaintext for `CREATE/ALTER RESOURCE` statements in FE logs and audit logs. - Does this need documentation: - No.
What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
This PR is scoped only to fixing plaintext leakage of
ai.api_keyinCREATE RESOURCEandALTER RESOURCEstatements.Before this change,
ai.api_keycould appear in FE runtime logs and audit logs when these resource statements were logged in their original form. This PR limits the fix to maskingai.api_keyforCREATE/ALTER RESOURCElogging paths only. It does not intend to expand masking coverage for other statement types or other logging paths in this PR.Release note
Mask
ai.api_keyin FE logs and audit logs forCREATE/ALTER RESOURCEstatements.Check List (For Author)
ai.api_keyis no longer logged in plaintext forCREATE/ALTER RESOURCEstatements in FE logs and audit logs.