Log debug statement logs Kafka secrets about pekko-connectors-kafka HOT 4 CLOSED

Looks like #100 missed some possible use cases. @mdedetrich could you have a quick look? I'm not too concerned because it is debug logging but it is something we will want to fix in a 1.0.1 release before too long.

from pekko-connectors-kafka.

@tkaszuba could you provide some hints about which properties are exposed?

I must admit to not understanding when it became the job of open source lib maintainers to redact logs and why companies don't write code or buy products to redact their logs if they choose to expose them to untrusted people.

from pekko-connectors-kafka.

That is odd, the PR I used should have fixed any instance of Pekko's ConsumerSettings printing out these secrets. Do note that in the implementation of #100 that was referenced, we use Kafka's own internal mechanism for stripping out sensitive values (i.e. Kafka uses this itself).

Can you double check that Kafka itself is also stripping these values by creating an equivalent base Java ConsumerSettings. Also would be helpful to state what is the kafka version and what maybe provide a redacted list of the settings that its printing out which it shouldn't

from pekko-connectors-kafka.

Thank you for answering and providing me details, I didn't know this is handled in newer versions. If you are in fact inheriting from the standard kafka libs than this is handled correctly already. Sorry for the confusion.

from pekko-connectors-kafka.