Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

executor: remove sensitive information in slow-log and statement (#18107) #18130

Merged
merged 2 commits into from
Jun 19, 2020

Conversation

ti-srebot
Copy link
Contributor

cherry-pick #18107 to release-4.0


Signed-off-by: crazycs520 crazycs520@gmail.com

What problem does this PR solve?

Before this PR, TiDB slow log will record sensitive information such as passwords in slow-log query.

This PR remove sensitive information in slow-log. Such as below:

execute below sql:

set tidb_slow_log_threshold=0;
create user u1 identified by "456789";
alter user 'u1'@'%' identified by 'abcd';
set password for 'u1'@'%' = 'abcsdafd';

The related slow-log will be:

create user {u1@% password = ***};
alter user {u1@% password = ***};
set password for user u1@%;

the related statement will be:

mysql>select query_sample_text from `STATEMENTS_SUMMARY` where query_sample_text like "set password%" or query_sample_text like "create user%" or query_sample_text like 'alter user%';
+-----------------------------------+
| query_sample_text                 |
+-----------------------------------+
| alter user {u1@% password = ***}  |
| create user {u1@% password = ***} |
| set password for user u1@%        |
+-----------------------------------+

What is changed and how it works?

Proposal: xxx

What's Changed:

How it Works:

Related changes

  • Need to cherry-pick to the release branch

Check List

Tests

  • Manual test (add detailed scripts or steps below)

Side effects

  • Performance regression
    • Consumes more CPU
    • Consumes more MEM
  • Breaking backward compatibility

Release note

  • Remove sensitive information in slow-log and statement.

Signed-off-by: ti-srebot <ti-srebot@pingcap.com>
@ti-srebot
Copy link
Contributor Author

/run-all-tests

@bb7133
Copy link
Member

bb7133 commented Jun 19, 2020

Please resolve the conflict

Signed-off-by: crazycs520 <crazycs520@gmail.com>
Copy link
Member

@bb7133 bb7133 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@bb7133 bb7133 added status/LGT1 Indicates that a PR has LGTM 1. and removed sig/sql-infra SIG: SQL Infra labels Jun 19, 2020
@crazycs520
Copy link
Contributor

/run-all-tests

@crazycs520
Copy link
Contributor

@kennytm PTAL

@github-actions github-actions bot added the sig/sql-infra SIG: SQL Infra label Jun 19, 2020
@crazycs520
Copy link
Contributor

/run-sqllogic-test-2

Copy link
Member

@wjhuang2016 wjhuang2016 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@bb7133 bb7133 merged commit a285fdf into pingcap:release-4.0 Jun 19, 2020
@crazycs520 crazycs520 deleted the release-4.0-dfca52cb0b64 branch June 19, 2020 09:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Everything related with security sig/execution SIG execution sig/sql-infra SIG: SQL Infra status/LGT1 Indicates that a PR has LGTM 1. type/4.0-cherry-pick
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants