SNOW-2316658: fixed session token leakage #930
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…d have verified this update works
sfc-gh-ext-simba-gc
requested review from
sfc-gh-ext-simba-hx and
sfc-gh-ext-simba-nl
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #930 +/- ##
==========================================
+ Coverage 79.59% 80.09% +0.49%
==========================================
Files 127 127
Lines 10913 10925 +12
==========================================
+ Hits 8686 8750 +64
+ Misses 2227 2175 -52 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
…ged with JSON patterns
…ken into masking test
…d buffer and updated parameters to terminal_masked()
…akedb/libsnowflakeclient into SNOW-2316658-sessionToken
…eating build errors for Mac and a test case that has similar functionality to test_renew_session.
sfc-gh-ext-simba-gc
requested review from
sfc-gh-pbulawa and
sfc-gh-turbaszek
sfc-gh-pbulawa
approved these changes
Nov 14, 2025
sfc-gh-snoonan
changed the title
sfc-gh-snoonan
approved these changes
Nov 25, 2025
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Teamwork issue #1314
There were 2 sources that contributed to leakage of Session Token and Master Token seen in debug logs. As suspected one source came from stderr. The second leak came from an internal call where the token string pattern was not expected.
For the session token leak that originated from stderr, I have added CURLINFO_TOKEN_PATTERN to our SecretDetector where text being dumped to terminal via stderr are masked when necessary.
For the second session token leak that originated from lack of option in an internal call (json_copy_string()), I have added "SessionToken" option in and have verified the fix worked.
2 test cases (test_terminal_mask and test_mask_stderr) have been added to tests/test_unit_logger.
I have verified the fix by running the two test cases that I've added as well as test_connect_with_renew in tests/test_unit_connect_parameters.c where the bug was originally reported and searching the terminal output for tokens and its values.