From 258b7d6f0679ff31c47aced464ddc8e4a4cd611d Mon Sep 17 00:00:00 2001
From: Zhengchao An <anzhengchao@gmail.com>
Date: Sun, 26 Jul 2026 05:24:34 +0800
Subject: [PATCH] fix(kms): do not include secret value in static KMS format
 error (#5243)

The malformed-format error message in build_static_kms_config embedded the
raw env var value. The most likely misconfiguration is setting
RUSTFS_KMS_STATIC_SECRET_KEY to the bare base64 key without the <key-name>:
prefix, in which case the full secret key material would be written to
startup logs. Drop the value from the message, matching the equivalent
parsing error in KmsConfig::from_env().
---
 rustfs/src/init.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/rustfs/src/init.rs b/rustfs/src/init.rs
index 86e2cbdf1..ab5b5317a 100644
--- a/rustfs/src/init.rs
+++ b/rustfs/src/init.rs
@@ -394,11 +394,11 @@ fn build_static_kms_config(cfg: &config::Config) -> std::io::Result<rustfs_kms::
         )));
     }
 
-    let colon_pos = secret_str.find(':').ok_or_else(|| {
-        Error::other(format!(
-            "Static KMS secret key must be in format <key-name>:<base64-key>, got: {secret_str}"
-        ))
-    })?;
+    // Do not include the value in the error: a malformed value is likely the raw
+    // secret key itself, and this message ends up in startup logs.
+    let colon_pos = secret_str
+        .find(':')
+        .ok_or_else(|| Error::other("Static KMS secret key must be in format <key-name>:<base64-key>"))?;
     let key_id = secret_str[..colon_pos].to_string();
     let secret_key = secret_str[colon_pos + 1..].to_string();