From ad5ccc98ec68e5ae1aa4718bf2231bb87847068f Mon Sep 17 00:00:00 2001 From: Qiang-Liu Date: Tue, 8 Sep 2026 04:23:12 +0000 Subject: [PATCH] fix(cli): sanitize store_addrs in kvbackend build log (#8967) * fix(cli): sanitize store_addrs in kvbackend build log Close #7525. The CLI's kvbackend construction log was printing raw store_addrs which could contain sensitive connection strings (e.g. PostgreSQL DSNs with passwords). Changes: - Add sanitize_store_addrs() helper that reuses common_meta::kv_backend::util::sanitize_connection_string(), consistent with MetasrvOptions and StartCommand patterns. - Replace raw store_addrs in the info! log with sanitized version. - Add unit tests covering MySQL URLs, PostgreSQL DSNs, etcd addresses, and empty store_addrs cases. Signed-off-by: qiang_liu Signed-off-by: qiang_liu Signed-off-by: LiuQhahah * fix(cli): drop redundant sanitize tests per review sanitize_connection_string in common_meta already covers MySQL URLs, PostgreSQL DSNs and credential-free etcd addresses with its own tests. The added tests only exercised a trivial map+collect wrapper, so remove them per review nit. Signed-off-by: LiuQhahah --------- Signed-off-by: qiang_liu Signed-off-by: qiang_liu Signed-off-by: LiuQhahah Co-authored-by: dennis zhuang --- src/cli/src/common/store.rs | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/cli/src/common/store.rs b/src/cli/src/common/store.rs index 34baaba4ff..e974037ea4 100644 --- a/src/cli/src/common/store.rs +++ b/src/cli/src/common/store.rs @@ -125,6 +125,14 @@ impl StoreConfig { } } + /// Sanitize store addrs for logging (redacts passwords in connection strings). + fn sanitize_store_addrs(&self) -> Vec { + self.store_addrs + .iter() + .map(|addr| common_meta::kv_backend::util::sanitize_connection_string(addr)) + .collect() + } + /// Builds a [`KvBackendRef`] from the store configuration. pub async fn build(&self) -> Result { let max_txn_ops = self.max_txn_ops; @@ -134,7 +142,7 @@ impl StoreConfig { } else { common_telemetry::info!( "Building kvbackend with store addrs: {:?}, backend: {:?}", - store_addrs, + &self.sanitize_store_addrs(), self.backend ); let kvbackend = match self.backend {