From 7e02853bee01e1bd692f6408e3bd683ea99d841c Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Mon, 24 Aug 2026 12:03:37 +0900 Subject: [PATCH] in_s3/out_s3: mask proxy_uri in the configuration dump Setting an authenticated proxy such as `http://user:pass@proxy:3128` to `proxy_uri` writes the password to the log in plain text, so mask it. `sts_http_proxy` already sets `secret: true`, so this makes the two consistent. Signed-off-by: Shizuo Fujita --- docs/input.md | 2 +- docs/output.md | 2 +- lib/fluent/plugin/in_s3.rb | 2 +- lib/fluent/plugin/out_s3.rb | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/input.md b/docs/input.md index cb9371c..534efc5 100644 --- a/docs/input.md +++ b/docs/input.md @@ -76,7 +76,7 @@ Check AWS key on start. Default is true. ## proxy_uri -URI of proxy environment. +URI of proxy environment. The value is masked in the configuration dump, so credentials embedded in the URI are not written to the log. ## \ section diff --git a/docs/output.md b/docs/output.md index ac01eda..0f8032f 100644 --- a/docs/output.md +++ b/docs/output.md @@ -312,7 +312,7 @@ Check AWS key on start. Default is true. ## proxy_uri -uri of proxy environment. +uri of proxy environment. The value is masked in the configuration dump, so credentials embedded in the URI are not written to the log. ## path diff --git a/lib/fluent/plugin/in_s3.rb b/lib/fluent/plugin/in_s3.rb index b27da68..459afaa 100644 --- a/lib/fluent/plugin/in_s3.rb +++ b/lib/fluent/plugin/in_s3.rb @@ -109,7 +109,7 @@ def initialize desc "Check AWS key on start" config_param :check_apikey_on_start, :bool, default: true desc "URI of proxy environment" - config_param :proxy_uri, :string, default: nil + config_param :proxy_uri, :string, default: nil, secret: true desc "Optional RegEx to match incoming messages" config_param :match_regexp, :regexp, default: nil diff --git a/lib/fluent/plugin/out_s3.rb b/lib/fluent/plugin/out_s3.rb index 35e332b..c6c1a51 100644 --- a/lib/fluent/plugin/out_s3.rb +++ b/lib/fluent/plugin/out_s3.rb @@ -121,7 +121,7 @@ def initialize desc "Check AWS key on start" config_param :check_apikey_on_start, :bool, default: true desc "URI of proxy environment" - config_param :proxy_uri, :string, default: nil + config_param :proxy_uri, :string, default: nil, secret: true desc "Use S3 reduced redundancy storage for 33% cheaper pricing. Deprecated. Use storage_class instead" config_param :reduced_redundancy, :bool, default: false, deprecated: "Use storage_class parameter instead." desc "The type of storage to use for the object(STANDARD,REDUCED_REDUNDANCY,STANDARD_IA)"