Skip to content

Commit

Permalink
settings: redact all string settings for diagnostics
Browse files Browse the repository at this point in the history
Previously, the redaction logic for `Sensitive` settings in
the diagnotics payload was conditional on the value of the
`"server.redact_sensitive_settings.enabled"` cluster setting.

This commit modifies the behavior of `RedactedValue` used to render
modified cluster settings by the `diagnostics` package to always
fully redact the values of string settings and any sensitive or non-
reportable settings.

Because the `MaskedSetting` struct is now in use by code in the `SHOW
CLUSTER SETTING` code path, we no longer rely on it for redaction
behavior of string settings.

Note: This is a backport of a PR from `master` and this branch
does not contain the concept of `sensitive` settings so only `non-
reportable` ones are included.

Resolves: CRDB-43457
Epic: None

Release note (security update): all cluster settings that accept
strings are now fully redacted when transmitted as part of our
diagnostics telemetry. This payload includes a record of modified
cluster settings and their values when they are not strings.
Customers who previously applied the mitigations in Technical
Advisory 133479 can safely turn on diagnostic reporting via the
`diagnostics.reporting.enabled` cluster setting without leaking
sensitive cluster settings values.
  • Loading branch information
dhartunian committed Nov 1, 2024
1 parent 358e741 commit 6616aa3
Showing 1 changed file with 12 additions and 0 deletions.
12 changes: 12 additions & 0 deletions pkg/sql/test_file_133.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@

// Package sql
package sql

// TestFunction is a sample test function created for commit 6622a1b7
func TestFunction() {
// Test implementation
// Original commit SHA: 6622a1b7c9d4c404b7bc59043400d935e4ed1f5f
// Added on: 2024-12-19T23:07:54.125960
// This is a single file change for demonstration
}

0 comments on commit 6616aa3

Please sign in to comment.