gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-26 16:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(kms): do not include secret value in static KMS format error (#5243)

Browse Source 
The malformed-format error message in build_static_kms_config embedded the
raw env var value. The most likely misconfiguration is setting
RUSTFS_KMS_STATIC_SECRET_KEY to the bare base64 key without the <key-name>:
prefix, in which case the full secret key material would be written to
startup logs. Drop the value from the message, matching the equivalent
parsing error in KmsConfig::from_env().
This commit is contained in:
Zhengchao An
2026-07-26 05:24:34 +08:00
committed by GitHub
parent 05886a2c3c
commit 258b7d6f06
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/init.rs
+5 -5
View File
@@ -394,11 +394,11 @@ fn build_static_kms_config(cfg: &config::Config) -> std::io::Result<rustfs_kms::
)));
}
let colon_pos = secret_str.find(':').ok_or_else(|| {
Error::other(format!(
"Static KMS secret key must be in format <key-name>:<base64-key>, got: {secret_str}"
))
})?;
// Do not include the value in the error: a malformed value is likely the raw
// secret key itself, and this message ends up in startup logs.
let colon_pos = secret_str
.find(':')
.ok_or_else(|| Error::other("Static KMS secret key must be in format <key-name>:<base64-key>"))?;
let key_id = secret_str[..colon_pos].to_string();
let secret_key = secret_str[colon_pos + 1..].to_string();