Add JDBC URL sanitizer to prevent credential exposure in logs #1136
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| package com.databricks.jdbc.common.util; | ||
|
|
||
| import java.util.regex.Pattern; | ||
|
|
||
| /** | ||
| * Security utility class for sanitizing sensitive information in logs and exception messages. | ||
| * | ||
| * <p>This class provides methods to redact credentials and other sensitive data from strings that | ||
| * might be logged or included in error messages, preventing accidental exposure of secrets in log | ||
| * files. | ||
| */ | ||
| public class SecurityUtil { | ||
|
|
||
| /** | ||
| * Pattern to match credential parameters in JDBC URLs. | ||
| * | ||
| * <p>Matches exact parameter names from DatabricksJdbcUrlParams that contain sensitive data: | ||
| * | ||
| * <ul> | ||
| * <li>password, pwd - Authentication passwords | ||
| * <li>OAuth2Secret - OAuth2 client secret | ||
| * <li>Auth_AccessToken - OAuth2 access token | ||
| * <li>Auth_RefreshToken, OAuthRefreshToken - OAuth2 refresh tokens | ||
| * <li>proxyuid, cfproxyuid - Proxy usernames (usernames are sensitive in proxy context) | ||
| * <li>proxypwd, cfproxypwd - Proxy passwords | ||
| * <li>Auth_JWT_Key_Passphrase - JWT key passphrase | ||
| * <li>SSLTrustStorePwd - SSL trust store password | ||
| * <li>SSLKeyStorePwd - SSL key store password | ||
| * <li>TokenCachePassPhrase - Token cache passphrase | ||
| * </ul> | ||
| * | ||
| * <p>Note: UID is not redacted as it's an identifier (e.g., email, username), not a secret like a | ||
| * password or token. | ||
| * | ||
| * <p>Pattern matches: - Parameter name (case-insensitive) - Equals sign - Value (everything until | ||
| * semicolon, ampersand, or end of string) | ||
| */ | ||
| private static final Pattern CREDENTIAL_PATTERN = | ||
| Pattern.compile( | ||
| "(password|pwd" | ||
| + "|OAuth2Secret" | ||
| + "|Auth_AccessToken" | ||
| + "|Auth_RefreshToken|OAuthRefreshToken" | ||
| + "|proxyuid|proxypwd" | ||
| + "|cfproxyuid|cfproxypwd" | ||
| + "|Auth_JWT_Key_Passphrase" | ||
| + "|SSLTrustStorePwd|SSLKeyStorePwd" | ||
| + "|TokenCachePassPhrase" | ||
| + ")=[^;&]*", | ||
| Pattern.CASE_INSENSITIVE); | ||
|
|
||
| /** Redaction string used to replace credential values. */ | ||
| private static final String REDACTED = "***REDACTED***"; | ||
|
|
||
| /** | ||
| * Sanitizes a JDBC URL by redacting credential parameters. | ||
| * | ||
| * <p>This method should be used whenever a JDBC URL needs to be logged or included in an | ||
| * exception message. It replaces the values of sensitive parameters with "***REDACTED***" while | ||
| * preserving the parameter names to aid in debugging. | ||
| * | ||
| * <p>Example: Input: {@code | ||
| * jdbc:databricks://host:443/default;PWD=secret123;UID=user@email.com;HttpPath=/sql/1.0} Output: | ||
| * {@code | ||
| * jdbc:databricks://host:443/default;PWD=***REDACTED***;UID=***REDACTED***;HttpPath=/sql/1.0} | ||
| * | ||
| * @param jdbcUrl the JDBC URL to sanitize, may be null | ||
| * @return sanitized URL with credentials redacted, or null if input was null | ||
| */ | ||
| public static String sanitizeJdbcUrl(String jdbcUrl) { | ||
| if (jdbcUrl == null) { | ||
| return null; | ||
| } | ||
| return CREDENTIAL_PATTERN.matcher(jdbcUrl).replaceAll("$1=" + REDACTED); | ||
| } | ||
|
|
||
| /** | ||
| * Sanitizes a connection string by redacting credential parameters. | ||
| * | ||
| * <p>Alias for {@link #sanitizeJdbcUrl(String)} to support different naming conventions. | ||
| * | ||
| * @param connectionString the connection string to sanitize, may be null | ||
| * @return sanitized connection string with credentials redacted, or null if input was null | ||
| */ | ||
| public static String sanitizeConnectionString(String connectionString) { | ||
| return sanitizeJdbcUrl(connectionString); | ||
| } | ||
|
|
||
| private SecurityUtil() { | ||
| // Utility class, prevent instantiation | ||
| } | ||
|
|
||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can we use the enums to build this pattern matching string so that we do not have to make changes at multiple places?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
how can we also further ensure that folks add newer connection params containing credentials to this list?