This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.1 by this push:
new 7b9870c44e1 [fix](security) Stop logging sensitive FE RPC requests
(#69472) (#69736)
7b9870c44e1 is described below
commit 7b9870c44e19b1c62db6e27246b0b89e050f504c
Author: Gavin Chou <[email protected]>
AuthorDate: Thu Oct 29 09:54:21 2026 +0800
[fix](security) Stop logging sensitive FE RPC requests (#69472) (#69736)
### What problem does this PR solve?
Backport https://github.com/apache/doris/pull/69472 to `branch-4.1`.
Several binlog, snapshot, and master-token RPC handlers log complete
Thrift requests at DEBUG or TRACE level. These requests can contain
password, passwd, or token credentials.
Remove the full-request logs from `getBinlog`, `getBinlogLag`,
`lockBinlog`, `getSnapshot`, `restoreSnapshot`, and `getMasterToken`.
Existing non-sensitive snapshot summary logs remain unchanged.
Cherry-picked from commit `e2dbcb8b1ad9d68147f91e81db1d45de4bdda794`.
### Release note
Prevent authentication credentials from being written to FE logs by
removing verbose request logging from the affected RPCs.
### Check List
- [x] `sh build.sh --fe`
- [x] `git diff --check`
- [x] No documentation changes are required.
Co-authored-by: gavinchou <[email protected]>
---
.../java/org/apache/doris/service/FrontendServiceImpl.java | 14 --------------
1 file changed, 14 deletions(-)
diff --git
a/fe/fe-core/src/main/java/org/apache/doris/service/FrontendServiceImpl.java
b/fe/fe-core/src/main/java/org/apache/doris/service/FrontendServiceImpl.java
index f08becb81b0..a27028595a3 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/service/FrontendServiceImpl.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/service/FrontendServiceImpl.java
@@ -3220,9 +3220,6 @@ public class FrontendServiceImpl implements
FrontendService.Iface {
public TGetBinlogResult getBinlog(TGetBinlogRequest request) throws
TException {
String clientAddr = getClientAddrAsString();
- if (LOG.isDebugEnabled()) {
- LOG.debug("receive get binlog request: {}", request);
- }
TGetBinlogResult result = new TGetBinlogResult();
TStatus status = new TStatus(TStatusCode.OK);
@@ -3339,7 +3336,6 @@ public class FrontendServiceImpl implements
FrontendService.Iface {
// getSnapshot
public TGetSnapshotResult getSnapshot(TGetSnapshotRequest request) throws
TException {
String clientAddr = getClientAddrAsString();
- LOG.trace("receive get snapshot info request: {}", request);
TGetSnapshotResult result = new TGetSnapshotResult();
TStatus status = checkMaster();
@@ -3453,7 +3449,6 @@ public class FrontendServiceImpl implements
FrontendService.Iface {
// Restore Snapshot
public TRestoreSnapshotResult restoreSnapshot(TRestoreSnapshotRequest
request) throws TException {
String clientAddr = getClientAddrAsString();
- LOG.trace("receive restore snapshot info request: {}", request);
TRestoreSnapshotResult result = new TRestoreSnapshotResult();
TStatus status = checkMaster();
@@ -3713,9 +3708,6 @@ public class FrontendServiceImpl implements
FrontendService.Iface {
public TGetMasterTokenResult getMasterToken(TGetMasterTokenRequest
request) throws TException {
String clientAddr = getClientAddrAsString();
- if (LOG.isDebugEnabled()) {
- LOG.debug("receive get master token request: {}", request);
- }
TGetMasterTokenResult result = new TGetMasterTokenResult();
TStatus status = checkMaster();
@@ -3743,9 +3735,6 @@ public class FrontendServiceImpl implements
FrontendService.Iface {
// getBinlogLag
public TGetBinlogLagResult getBinlogLag(TGetBinlogRequest request) throws
TException {
String clientAddr = getClientAddrAsString();
- if (LOG.isDebugEnabled()) {
- LOG.debug("receive get binlog lag request: {}", request);
- }
TGetBinlogLagResult result = new TGetBinlogLagResult();
TStatus status = checkMaster();
@@ -3845,9 +3834,6 @@ public class FrontendServiceImpl implements
FrontendService.Iface {
public TLockBinlogResult lockBinlog(TLockBinlogRequest request) throws
TException {
String clientAddr = getClientAddrAsString();
- if (LOG.isDebugEnabled()) {
- LOG.debug("receive lock binlog request: {}", request);
- }
TLockBinlogResult result = new TLockBinlogResult();
TStatus status = checkMaster();
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
