Skip to content

fix: redact RabbitMQ URL in dial failure logs - #4418

Merged
igor-kupczynski merged 1 commit into
mainfrom
redact-rabbitmq-url-in-dial-logs
Jul 14, 2026
Merged

fix: redact RabbitMQ URL in dial failure logs#4418
igor-kupczynski merged 1 commit into
mainfrom
redact-rabbitmq-url-in-dial-logs

Conversation

@igor-kupczynski

@igor-kupczynski igor-kupczynski commented Jul 14, 2026

Copy link
Copy Markdown
Contributor
  • The cannot (re)dial error logs in internal/msgqueue/rabbitmq/channel_pool.go printed the raw RabbitMQ connection URL, potentially leaking the username and password into logs (and any log aggregation) whenever a dial failed — e.g. during credential rotation.
  • Added a small redactURL helper (stdlib net/url + URL.Redacted()) that masks the password as xxxxx; unparseable URLs log <unparseable url> instead of the raw value. The redacted URL is computed once in newChannelPool and used at both log sites, keeping host/port visible for debugging.

@vercel

vercel Bot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hatchet-docs Ready Ready Preview, Comment Jul 14, 2026 2:44pm

Request Review

@github-actions github-actions Bot added the engine Related to the core Hatchet engine label Jul 14, 2026
@igor-kupczynski igor-kupczynski changed the title fix: redact RabbitMQ credentials in dial failure logs fix: redact RabbitMQ URL in dial failure logs Jul 14, 2026
@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Benchmark results

goos: linux
goarch: amd64
pkg: github.com/hatchet-dev/hatchet/internal/msgqueue/rabbitmq
cpu: AMD Ryzen 9 7950X3D 16-Core Processor          
                              │ /tmp/old.txt │            /tmp/new.txt            │
                              │    sec/op    │   sec/op     vs base               │
CompressPayloads_1x10KiB-8      85.84µ ±  6%   90.29µ ± 4%   +5.19% (p=0.015 n=6)
CompressPayloads_10x10KiB-8     940.5µ ±  4%   989.9µ ± 6%   +5.26% (p=0.015 n=6)
CompressPayloads_10x100KiB-8    12.61m ± 14%   11.49m ± 3%   -8.90% (p=0.002 n=6)
CompressPayloads_Concurrent-8   74.82µ ±  9%   93.13µ ± 3%  +24.46% (p=0.002 n=6)
geomean                         525.4µ         556.1µ        +5.85%

                              │ /tmp/old.txt │            /tmp/new.txt            │
                              │     B/op     │     B/op      vs base              │
CompressPayloads_1x10KiB-8      10.99Ki ± 1%   10.95Ki ± 1%       ~ (p=1.000 n=6)
CompressPayloads_10x10KiB-8     108.4Ki ± 1%   108.7Ki ± 1%       ~ (p=1.000 n=6)
CompressPayloads_10x100KiB-8    2.920Mi ± 0%   2.920Mi ± 0%       ~ (p=0.186 n=6)
CompressPayloads_Concurrent-8   54.43Ki ± 0%   54.54Ki ± 0%       ~ (p=0.394 n=6)
geomean                         118.0Ki        118.0Ki       +0.01%

                              │ /tmp/old.txt │            /tmp/new.txt            │
                              │  allocs/op   │ allocs/op   vs base                │
CompressPayloads_1x10KiB-8        5.000 ± 0%   5.000 ± 0%       ~ (p=1.000 n=6) ¹
CompressPayloads_10x10KiB-8       32.00 ± 0%   32.00 ± 0%       ~ (p=1.000 n=6) ¹
CompressPayloads_10x100KiB-8      63.00 ± 2%   63.00 ± 2%       ~ (p=1.000 n=6)
CompressPayloads_Concurrent-8     17.00 ± 0%   17.00 ± 0%       ~ (p=1.000 n=6) ¹
geomean                           20.35        20.35       +0.00%
¹ all samples are equal

Compared against main (7adadb8)

@igor-kupczynski
igor-kupczynski force-pushed the redact-rabbitmq-url-in-dial-logs branch from 9a9a781 to 45c90d6 Compare July 14, 2026 14:38
@github-actions github-actions Bot added documentation Improvements or additions to documentation sdk-py Related to the Python sdk labels Jul 14, 2026
@igor-kupczynski
igor-kupczynski force-pushed the redact-rabbitmq-url-in-dial-logs branch from 45c90d6 to 498f696 Compare July 14, 2026 14:40
@github-actions github-actions Bot removed documentation Improvements or additions to documentation sdk-py Related to the Python sdk labels Jul 14, 2026
@igor-kupczynski
igor-kupczynski marked this pull request as ready for review July 14, 2026 14:42
@igor-kupczynski
igor-kupczynski merged commit e8ba74c into main Jul 14, 2026
55 checks passed
@igor-kupczynski
igor-kupczynski deleted the redact-rabbitmq-url-in-dial-logs branch July 14, 2026 14:44
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Optional test failure: The load-deadlock job failed on this PR (optimistic-scheduling=false). This check is non-mandatory and does not block merging, but may be worth investigating. View logs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

engine Related to the core Hatchet engine

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants