milenkovicm commented on code in PR #2537:
URL:
https://github.com/apache/datafusion-ballista/pull/2537#discussion_r4180789937
##########
ballista/core/src/utils.rs:
##########
@@ -415,10 +416,104 @@ pub fn get_current_time() -> u128 {
.as_millis()
}
+/// Logged in place of a configuration value that may be a secret.
+pub const REDACTED: &str = "<redacted>";
+
+/// Parts of a configuration key that mark its value as a possible secret.
+const SENSITIVE_KEY_PARTS: [&str; 6] = [
+ "secret",
+ "password",
+ "token",
+ "credential",
+ "api_key",
+ "private_key",
+];
+
+/// Returns `value` as it may appear in a log line: unchanged, or [`REDACTED`]
+/// if `key` looks like it names a secret.
+///
+/// Session configuration travels as plain key/value pairs, including config
+/// extensions Ballista knows nothing about, so the key name is all there is to
+/// go on. A key is sensitive if it contains `secret`, `password`, `token`,
+/// `credential`, `api_key` or `private_key`, ignoring case.
+pub fn redact_config_value<'a>(key: &str, value: &'a str) -> &'a str {
+ let key = key.to_ascii_lowercase();
+ if SENSITIVE_KEY_PARTS.iter().any(|part| key.contains(part)) {
+ REDACTED
Review Comment:
I would suggest to add value length as well? it helps with debugging,
something similar to
```
<redacted> length: 12
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
