Skip to content

Commit 8343ef2

Browse files
authored
fix(sas): drop logger.info call leaking user password (#27786)
`SASClient.get_token` logged the cleartext password (and username + token response body) at INFO level on every auth call. The line appears to be debug spam left in by mistake. Verified leak path (static + runtime): - `__init__` calls `get_token(serverHost, username, password.get_secret_value())` - `password.get_secret_value()` returns the raw user password (Pydantic SecretStr unwrap) - `get_token` interpolates that into an f-string at INFO - Triggered every time a SAS connector is instantiated - `ingestion_logger()` has no redaction filter, so the cleartext reaches whatever sink (stdout, file, airflow logs, CloudWatch, etc.) is configured
1 parent e9c87c6 commit 8343ef2

1 file changed

Lines changed: 0 additions & 2 deletions

File tree

  • ingestion/src/metadata/ingestion/source/database/sas

ingestion/src/metadata/ingestion/source/database/sas/client.py

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,4 @@ def get_token(self, base_url, user, password):
168168
}
169169
url = base_url + endpoint
170170
response = requests.request("POST", url, headers=headers, data=payload, verify=False, timeout=10)
171-
text_response = response.json()
172-
logger.info(f"this is user: {user}, password: {password}, text: {text_response}")
173171
return response.json()["access_token"]

0 commit comments

Comments
 (0)