api,sink: mask sink uri secrets in errors#5363
Conversation
|
Skipping CI for Draft Pull Request. |
ti-chi-bot
Bot
added
release-note-none
|
This cherry pick PR is for a release branch and has not yet been approved by triage owners. To merge this cherry pick:
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ti-chi-bot
Bot
added
the
size/L
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces changes to mask sensitive data (such as credentials) in sink URIs and URL errors across various components, including API endpoints, downstream adapters, and cluster checks. It adds utility functions to mask sensitive query parameters and redact invalid URIs, along with comprehensive unit tests. The review feedback highlights critical security improvements: traversing the error chain in MaskSensitiveDataInURLError to ensure wrapped errors are properly masked, and using the newly introduced genSinkURIInvalidError helper when sink.Verify fails to prevent potential credential leaks in API responses.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| func MaskSensitiveDataInURLError(err error) error { | ||
| if err == nil { | ||
| return nil | ||
| } | ||
| urlErr, ok := err.(*url.Error) | ||
| if !ok { | ||
| return err | ||
| } | ||
| return &url.Error{ | ||
| Op: urlErr.Op, | ||
| URL: MaskSensitiveDataInURIForError(urlErr.URL), | ||
| Err: urlErr.Err, | ||
| } | ||
| } |
There was a problem hiding this comment.
In Go (and especially TiCDC), errors are frequently wrapped using errors.Trace or other wrapping mechanisms. The current implementation of MaskSensitiveDataInURLError uses a direct type assertion err.(*url.Error), which will fail to detect and mask the sensitive URL if the error is wrapped.
We should traverse the error chain to find and mask the nested *url.Error in-place, ensuring that sensitive credentials are never leaked even when the error is wrapped.
| func MaskSensitiveDataInURLError(err error) error { | |
| if err == nil { | |
| return nil | |
| } | |
| urlErr, ok := err.(*url.Error) | |
| if !ok { | |
| return err | |
| } | |
| return &url.Error{ | |
| Op: urlErr.Op, | |
| URL: MaskSensitiveDataInURIForError(urlErr.URL), | |
| Err: urlErr.Err, | |
| } | |
| } | |
| func MaskSensitiveDataInURLError(err error) error { | |
| if err == nil { | |
| return nil | |
| } | |
| type unwrapper interface { | |
| Unwrap() error | |
| } | |
| for curr := err; curr != nil; { | |
| if urlErr, ok := curr.(*url.Error); ok { | |
| urlErr.URL = MaskSensitiveDataInURIForError(urlErr.URL) | |
| return err | |
| } | |
| u, ok := curr.(unwrapper) | |
| if !ok { | |
| break | |
| } | |
| curr = u.Unwrap() | |
| } | |
| return err | |
| } |
| err = sink.Verify(ctx, cfConfig, changefeedID) | ||
| if err != nil { | ||
| _ = c.Error(errors.WrapError(errors.ErrSinkURIInvalid, err, cfg.SinkURI)) | ||
| _ = c.Error(errors.WrapError(errors.ErrSinkURIInvalid, err, maskSinkURIForError(cfg.SinkURI))) |
There was a problem hiding this comment.
If sink.Verify fails, it can return a *url.Error (e.g., due to connection or DNS issues). Wrapping err directly without util.MaskSensitiveDataInURLError will leak the sensitive credentials in the API response.
We should use genSinkURIInvalidError here, which automatically masks both the err (if it contains a *url.Error) and the sinkURI.
| _ = c.Error(errors.WrapError(errors.ErrSinkURIInvalid, err, maskSinkURIForError(cfg.SinkURI))) | |
| _ = c.Error(genSinkURIInvalidError(cfg.SinkURI, err)) |
| err = sink.Verify(ctx, oldCfInfo.ToChangefeedConfig(), oldCfInfo.ChangefeedID) | ||
| if err != nil { | ||
| _ = c.Error(errors.WrapError(errors.ErrSinkURIInvalid, err, oldCfInfo.SinkURI)) | ||
| _ = c.Error(errors.WrapError(errors.ErrSinkURIInvalid, err, maskSinkURIForError(oldCfInfo.SinkURI))) |
There was a problem hiding this comment.
If sink.Verify fails during changefeed update, it can return a *url.Error containing sensitive credentials. Wrapping err directly without util.MaskSensitiveDataInURLError will leak these credentials in the API response.
We should use genSinkURIInvalidError here to ensure both the nested error and the URI are properly masked.
| _ = c.Error(errors.WrapError(errors.ErrSinkURIInvalid, err, maskSinkURIForError(oldCfInfo.SinkURI))) | |
| _ = c.Error(genSinkURIInvalidError(oldCfInfo.SinkURI, err)) |
ti-chi-bot
Bot
removed
the
do-not-merge/work-in-progress
|
/test all |
|
/test all |
ti-chi-bot
Bot
added
needs-1-more-lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: 3AceShowHand, wk989898 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
ti-chi-bot
Bot
added
lgtm
and removed
needs-1-more-lgtm
[LGTM Timeline notifier]Timeline:
|
|
This cherry pick PR is for a release branch and has not yet been approved by triage owners. To merge this cherry pick:
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
What problem does this PR solve?
Issue Number: ref #5094
Backport #5093 to
release-8.5so sensitive sink URI data is not exposed through sink parsing and validation errors.What is changed and how it works?
Cherry-picked the three commits from #5093 onto
release-8.5:4d95fd459api,sink: mask sink uri secrets in errorsb6a114a94update git ignore71275a7fdapi,sink: preserve sanitized uri parse errorsThe backport masks sink URI credentials in OpenAPI create/update/resume/verify-table paths, sink
New/Verify, and shared cluster checks. It also preserves sanitized URI parse errors by redactingurl.Errorcontents. During conflict resolution,pkg/check/active_active_tso_indexes.gohunks were omitted because that file does not exist onrelease-8.5.Check List
Tests
Questions
Will it cause performance regression or break compatibility?
No. It only changes error message redaction for invalid or unsupported sink URI paths.
Do you need to update user documentation, design documentation or monitoring documentation?
No.
Release note