[VL] Fix password leak in debug-mode config logging

cpp/core/config/GlutenConfig.cc

@@ -19,19 +19,22 @@
 
 #include <boost/regex.hpp>
 #include <jni.h>
-#include <optional>
 #include "compute/ProtobufUtils.h"
 #include "config.pb.h"
 #include "jni/JniError.h"
 
 namespace {
 
-std::optional<boost::regex> getRedactionRegex(const std::unordered_map<std::string, std::string>& conf) {
+// Mirrors Spark's built-in default for spark.redaction.regex.
+// See org.apache.spark.internal.config.SECRET_REDACTION_PATTERN.
+constexpr std::string_view kDefaultRedactionRegex = "(?i)secret|password|token|access[.]?key";
+
+boost::regex getRedactionRegex(const std::unordered_map<std::string, std::string>& conf) {
   auto it = conf.find(gluten::kSparkRedactionRegex);
   if (it != conf.end()) {
     return boost::regex(it->second);
   }
-  return std::nullopt;
+  return boost::regex(kDefaultRedactionRegex.data());
 }
 } // namespace
 
@@ -67,7 +70,7 @@ std::string printConfig(const std::unordered_map<std::string, std::string>& conf
   auto redactionRegex = getRedactionRegex(conf);
 
   for (const auto& [k, v] : conf) {
-    if (redactionRegex && boost::regex_match(k, *redactionRegex)) {
+    if (boost::regex_search(k, redactionRegex)) {
       oss << " [" << k << ", " << kSparkRedactionString << "]\n";
     } else {
       oss << " [" << k << ", " << v << "]\n";

cpp/core/tests/CMakeLists.txt

@@ -17,3 +17,4 @@ add_test_case(round_robin_partitioner_test SOURCES RoundRobinPartitionerTest.cc)
 add_test_case(object_store_test SOURCES ObjectStoreTest.cc)
 add_test_case(memory_allocator_test SOURCES MemoryAllocatorTest.cc)
 add_test_case(ffor_codec_test SOURCES FForCodecTest.cc)
+add_test_case(print_config_test SOURCES PrintConfigTest.cc)

cpp/core/tests/PrintConfigTest.cc

@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+#include "config/GlutenConfig.h"
+
+namespace gluten {
+
+// Helpers to check whether a key's value is redacted or plain in the output.
+static bool isRedacted(const std::string& output, const std::string& key) {
+  // Look for the pattern " [<key>, *********(redacted)]"
+  return output.find("[" + key + ", " + kSparkRedactionString + "]") != std::string::npos;
+}
+
+static bool isPlain(const std::string& output, const std::string& key, const std::string& value) {
+  return output.find("[" + key + ", " + value + "]") != std::string::npos;
+}
+
+// ── Default-redaction tests (no spark.redaction.regex in config) ─────────────
+
+TEST(PrintConfig, DefaultRedactsPassword) {
+  std::unordered_map<std::string, std::string> conf = {
+      {"spark.datasource.jdbc.password", "secret123"},
+  };
+  auto out = printConfig(conf);
+  EXPECT_TRUE(isRedacted(out, "spark.datasource.jdbc.password"));
+}
+
+TEST(PrintConfig, DefaultRedactsSecret) {
+  std::unordered_map<std::string, std::string> conf = {
+      {"my.secret.value", "topsecret"},
+  };
+  auto out = printConfig(conf);
+  EXPECT_TRUE(isRedacted(out, "my.secret.value"));
+}
+
+TEST(PrintConfig, DefaultRedactsToken) {
+  std::unordered_map<std::string, std::string> conf = {
+      {"spark.hadoop.fs.s3a.access.token", "tok_abc123"},
+  };
+  auto out = printConfig(conf);
+  EXPECT_TRUE(isRedacted(out, "spark.hadoop.fs.s3a.access.token"));
+}
+
+TEST(PrintConfig, DefaultRedactsAccessKey) {
+  std::unordered_map<std::string, std::string> conf = {
+      {"spark.hadoop.fs.s3a.accesskey", "AKIAIOSFODNN7EXAMPLE"},
+  };
+  auto out = printConfig(conf);
+  EXPECT_TRUE(isRedacted(out, "spark.hadoop.fs.s3a.accesskey"));
+}
+
+TEST(PrintConfig, DefaultDoesNotRedactSafeKey) {
+  std::unordered_map<std::string, std::string> conf = {
+      {"spark.sql.session.timeZone", "UTC"},
+  };
+  auto out = printConfig(conf);
+  EXPECT_TRUE(isPlain(out, "spark.sql.session.timeZone", "UTC"));
+}
+
+// ── Custom-regex tests (spark.redaction.regex present) ───────────────────────
+
+TEST(PrintConfig, CustomRegexRedactsMatchingKey) {
+  std::unordered_map<std::string, std::string> conf = {
+      {kSparkRedactionRegex, "supersensitive"},
+      {"my.supersensitive.config", "very_private"},
+      {"spark.sql.session.timeZone", "UTC"},
+  };
+  auto out = printConfig(conf);
+  EXPECT_TRUE(isRedacted(out, "my.supersensitive.config"));
+  EXPECT_TRUE(isPlain(out, "spark.sql.session.timeZone", "UTC"));
+}
+
+TEST(PrintConfig, CustomRegexOverridesDefault) {
+  // When spark.redaction.regex is set, only keys matching it are redacted.
+  // A key that would match the default pattern (e.g. "password") but NOT the
+  // custom regex must be printed in plain text.
+  std::unordered_map<std::string, std::string> conf = {
+      {kSparkRedactionRegex, "supersensitive"},
+      {"spark.datasource.jdbc.password", "pass123"},
+  };
+  auto out = printConfig(conf);
+  EXPECT_TRUE(isPlain(out, "spark.datasource.jdbc.password", "pass123"));
+}
+
+TEST(PrintConfig, CaseInsensitiveDefaultRedaction) {
+  std::unordered_map<std::string, std::string> conf = {
+      {"spark.my.PASSWORD", "uppercase_pw"},
+  };
+  auto out = printConfig(conf);
+  EXPECT_TRUE(isRedacted(out, "spark.my.PASSWORD"));
+}
+
+} // namespace gluten