From b3e50bb12f081a5e40e19cd30c99b423a8e960fa Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 1 Apr 2026 23:23:56 -0700 Subject: [PATCH] fix(s3): remove customer encryption key from SSE-C debug log (#8875) * fix(s3): remove customer encryption key from SSE-C debug log The debug log in validateAndParseSSECHeaders was logging the raw customer-provided encryption key bytes in hex format (keyBytes=%x), leaking sensitive key material to log output. Remove the key bytes from the log statement while keeping the MD5 hash comparison info. * Apply suggestion from @gemini-code-assist[bot] Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- weed/s3api/s3_sse_c.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/weed/s3api/s3_sse_c.go b/weed/s3api/s3_sse_c.go index eec2bc7ac..79cf96041 100644 --- a/weed/s3api/s3_sse_c.go +++ b/weed/s3api/s3_sse_c.go @@ -58,9 +58,9 @@ var ( // SSECustomerKey represents a customer-provided encryption key for SSE-C type SSECustomerKey struct { - Algorithm string - Key []byte - KeyMD5 string + Algorithm string + Key []byte + KeyMD5 string } // IsSSECRequest checks if the request contains SSE-C headers @@ -119,8 +119,8 @@ func validateAndParseSSECHeaders(algorithm, key, keyMD5 string) (*SSECustomerKey sum := md5.Sum(keyBytes) expectedMD5 := base64.StdEncoding.EncodeToString(sum[:]) - // Debug logging for MD5 validation - glog.V(4).Infof("SSE-C MD5 validation: provided='%s', expected='%s', keyBytes=%x", keyMD5, expectedMD5, keyBytes) + // Debug logging for MD5 validation (never log key material) + glog.V(4).Infof("SSE-C MD5 validation: provided='%s', expected='%s'", keyMD5, expectedMD5) if keyMD5 != expectedMD5 { glog.Errorf("SSE-C MD5 mismatch: provided='%s', expected='%s'", keyMD5, expectedMD5)