fix: remove credential-leaking log statements in sls-logger, hmac-auth, tcp-logger, udp-logger#13205
Merged
Baoyuantop merged 1 commit intoApr 14, 2026
Conversation
…h, tcp-logger, udp-logger Remove debug info-level log statements that exposed sensitive data: - sls-logger: rf5424_data containing access-key-secret logged on each log flush - hmac-auth: canonical header names and values (may include Authorization/Cookie) logged during HMAC signature generation - tcp-logger: full serialized log_message payload logged before send - udp-logger: full serialized log_message payload logged before send Add regression tests by hooking batch-processor-manager to verify body capture still works correctly after removing the debug statements.
dosubot
Bot
added
size:M
nic-6443
approved these changes
Apr 13, 2026
shreemaan-abhishek
approved these changes
Apr 14, 2026
membphis
approved these changes
Apr 14, 2026
5 tasks
wistefan
pushed a commit
to wistefan/apisix
that referenced
this pull request
Jun 16, 2026
…h, tcp-logger, udp-logger (apache#13205)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remove debug
core.log.infostatements that exposed sensitive credentials in nginx error logs at info level.Vulnerabilities Fixed
sls-logger.lua: Therf5424_datastring (containingaccess-key-secret) was logged incombine_syslog()and_M.log()on each log flush.hmac-auth.lua: Canonical header names and values (which may includeAuthorizationandCookieheaders) were logged during HMAC signature generation.tcp-logger.lua/udp-logger.lua: The full serializedlog_messagepayload (containing all request headers and body) was logged before each send.Changes
Plugin fixes (
apisix/plugins/):core.log.infolines across 4 plugin files (sls-logger.lua,hmac-auth.lua,tcp-logger.lua,udp-logger.lua).Regression tests (
t/plugin/):sls-logger.t: Addextra_init_by_luahook onbatch_processor_manager.add_entry_to_new_processorto printentry.data(the raw RFC5424-encoded string) to the error log. Existing TEST 14 and TEST 15--- error_logassertions continue to verify that request/response body is captured and forwarded correctly.tcp-logger.t/udp-logger.t: Same hook pattern usingcore.json.encode(entry). Existing TEST 16/17 and TEST 13/14--- error_logassertions continue to verify body collection works end-to-end.