[Security/Privacy] Keep invalid replica configuration values out of startup diagnostics

[seonghobae]

Buyer / acquisition gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 includes replica-configuration validators that echo the complete rejected configuration value into thrown startup diagnostics:

throw new IllegalStateException("Invalid host for " + key + ": " + value);
throw new IllegalStateException("Invalid port for " + key + ": " + value);
throw new IllegalStateException("Invalid value for " + key + ": " + value);

ReplicaJdbcTemplateConfig also echoes an invalid REPLICA_HIKARI_INITIALIZATION_FAIL_TIMEOUT_MS value and attaches the NumberFormatException cause. The validated fields are deployment/network/database configuration. A malformed value can contain connection-string fragments, internal host/database names, query material, control characters, or operator-supplied secret-adjacent text even though the accepted grammar is intentionally narrow. Startup/configuration failure evidence needs the configuration key and a stable reason, not the rejected raw value or parser cause.

Status: known_gap. Current open-PR search found no active PR claiming ValidationUtils or ReplicaJdbcTemplateConfig; recheck exact changed paths immediately before any write.

RCA

• Immediate cause: validation exceptions concatenate the rejected raw input and, for the timeout parser, retain the parse exception as the cause.
• Technical root cause: validation classification and diagnostic transport are coupled; the value is used as error-display material after validation has already established that it is outside the accepted contract.
• Control failure: ValidationUtilsTest verifies only that invalid values throw, while ReplicaJdbcTemplateConfigTest verifies only that the timeout key appears in the startup failure. No test asserts confidentiality, bounded output, or control-character exclusion.
• Security/operability impact: startup errors commonly flow into application logs, container logs, CI diagnostics, deployment events, and support bundles. Echoing rejected configuration expands those channels without improving the remediation instruction.

Bounded remediation

Use strict RED → GREEN on the real validator/configuration boundary:

1. Keep the configuration key and a stable finite classification such as Invalid host for REPLICA_PGHOST.
2. Do not include the rejected raw value, query fragments, credential-like text, control characters, parser exception message, or stack-derived details in the ordinary exception message/cause merely for validation reporting.
3. Preserve all accepted host/port/identifier grammars and trimmed return values.
4. Preserve the documented -1 Hikari initialization-fail-timeout default and accepted numeric behavior; this slice is diagnostic confidentiality, not a timeout-policy redesign.
5. Add beginner-readable Javadoc to the public utility methods while touching the class.
6. Do not implement regex masking; simply do not transport invalid input that the caller does not need.

TDD acceptance

Fail-first tests must inject realistic invalid values containing a credential-bearing JDBC/query fragment and control characters and prove protected source republishes them today. Final acceptance must prove:

• invalid host, port, and identifier errors name only the stable configuration key/classification and omit the raw input;
• invalid Hikari timeout startup failure names the configuration key but omits the rejected value and parser diagnostic;
• null/blank/malformed/range-invalid cases remain fail-closed;
• all accepted values and trim behavior are unchanged;
• no secret/host/database value is added to logs, metrics, traces, PR text, or documentation merely for debugging;
• focused/full CDC tests pass with non-vacuous owned-production coverage under the accepted repository coverage authority;
• current dependency/SBOM/SAST/security and exact-source/review gates pass before protected integration;
• canonical Security/Threat Model/Test Strategy/Operability/Traceability reconcile the diagnostic boundary when docs: establish canonical commercial architecture baseline #149/[Documentation] Close canonical architecture coverage and live traceability gaps #159 is safe.

Standards evidence

OWASP's current Logging Cheat Sheet says database connection strings, authentication passwords, access tokens, keys, sensitive personal data, and other higher-classification data should usually not be recorded directly, and notes that internal network names/addresses and file paths can also require special handling. MITRE CWE-532 defines the weakness as inserting sensitive information into log files and recommends avoiding secrets/system details in logs.

References — APA 7

OWASP Foundation. (2026). Logging cheat sheet. OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html

MITRE. (2026). CWE-532: Insertion of sensitive information into log file. Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/532.html

Relationships: #159 canonical documentation; #182 production-safe observability defaults; #170–#176 CDC/connector diagnostic-confidentiality controls; #196 security-evidence completeness.

[seonghobae]

Execution evidence — 2026-08-10

Draft PR #211 is now carrying two independent test-first boundaries from exact protected develop@622e5e6c3d534f230c390f10e3832efadfc01825.

1. Rejected host/port/identifier diagnostics

   • RED source 1554b06531624f2a040fa168094bd16b92fc845c.
   • CI 31354494169, macOS job 93351514720, reached the real ValidationUtils boundary with the rest of the reactor setup healthy and failed exactly the new confidentiality assertion because the rejected secret/control-character-bearing value was republished.
   • GREEN source f4e8c2e7b30560aec1f0bea689ed5e36d5820019 removes raw rejected values/parser causes from those validation messages, preserves stable configuration keys and accepted grammar/trim/range behavior, and adds public Javadocs.
   • CI 31354655501, macOS job 93352013703, then ran ValidationUtilsTest 7/7 green, CDC 107/107 green, ETL 275/275 green and completed the full reactor successfully on GitHub's synthetic merge preview. This is development compatibility proof, not literal-source merge evidence.

2. Invalid Hikari initialization-fail timeout diagnostics

   • RED source 1bf28722fc6c9769114dcaae90c5bf149c09d040 added only the startup-boundary regression.
   • CI 31354722925, macOS job 93352195470, checked out synthetic merge 79f12db6a8e9219bd5d4feb02c6aec652242deca and ran ETL 275 tests green. CDC then ran 107 tests with exactly one failure, zero errors/skips: ReplicaJdbcTemplateConfigTest.invalidInitializationFailTimeoutDoesNotRepublishRejectedValueOrParserDiagnostics. The Spring startup warning itself showed the rejected timeout text being included in the bean-creation diagnostic, so RED reached the intended production configuration boundary.
   • Current GREEN candidate 754bc6395744f20421f3fc64bb65b74bfe145eff keeps the stable key, stops attaching the rejected raw value and NumberFormatException, preserves existing default/numeric semantics, and adds beginner-readable public configuration Javadocs.
   • Current-head workflows 31354870193/201/213/246/261 are queued at this comment time and therefore are not passing evidence yet.

The same hosted logs continue to reproduce the shared protected JaCoCo zero-class false-green (#162/#164/#205), so #211 remains Draft regardless of behavior GREEN. #196 scanner completeness, #121 exact-source authority, and independent review also remain separate gates.

[seonghobae]

Current GREEN verification update — 2026-08-10

Exact current PR #211 source 754bc6395744f20421f3fc64bb65b74bfe145eff has now completed CI 31354870261 successfully on Ubuntu, macOS, and Windows. macOS job 93352584917 checked out synthetic merge b42309da3dee1126f513bb8bf20cda636b3620a3 (Merge 754bc639... into protected develop@622e5e6...) and proved:

• ETL 275/275 tests green;
• CDC 107/107 tests green;
• ValidationUtilsTest 7/7 green;
• ReplicaJdbcTemplateConfigTest 4/4 green;
• gateway tests green;
• full Maven reactor BUILD SUCCESS.

The invalid-timeout startup warning now exposes only the stable key REPLICA_HIKARI_INITIALIZATION_FAIL_TIMEOUT_MS; the rejected timeout value and NumberFormatException are absent from the visible startup diagnostic. The earlier raw host/port/database validation regressions remain green on the same integration tree.

Dependency Review 31354870213, CycloneDX SBOM 31354870201, and SAST Semgrep 31354870193 are also successful. Security Scan 31354870246 remains queued at this update and is therefore not passing. This remains merged-tree development evidence, not accepted literal-source or release evidence. Protected JaCoCo still selects zero ETL classes (#162/#164/#205); #196 scanner completeness, #121 exact-source authority, and independent review remain separate gates.

[seonghobae]

Exact-current-head gate update — 2026-08-10

PR #211 remains unchanged at source 754bc6395744f20421f3fc64bb65b74bfe145eff. Security Scan 31354870246 has now completed successfully, so all five exposed aggregate workflows associated with that source head are terminal-success: CI 31354870261, Dependency Review 31354870213, CycloneDX SBOM 31354870201, SAST Semgrep 31354870193, and Security Scan 31354870246.

This does not change the protected-merge classification. Current source-executing workflows use GitHub's synthetic pull-request merge revision rather than accepted literal source; protected JaCoCo remains non-vacuous only after #162/#164 and repository-wide scope remains #205; #196 dependency-resolution completeness and qualifying independent review are separate acceptance dimensions. Keep #210 open with #211 as active_pr until the behavior is integrated and protected-source evidence is regenerated.

[seonghobae]

Live implementation reconciliation (2026-08-10): this issue is no longer known_gap without an owner. Draft PR #211 is the bounded direct-develop implementation on unchanged protected develop@622e5e6c3d534f230c390f10e3832efadfc01825, exact source head 754bc6395744f20421f3fc64bb65b74bfe145eff (fix/cdc-validation-diagnostic-confidentiality-622e5e6). Its strict two-stage RED→GREEN path covers both ValidationUtils rejected host/port/identifier values and invalid REPLICA_HIKARI_INITIALIZATION_FAIL_TIMEOUT_MS, preserving accepted validation/default semantics while removing raw rejected input and parser-cause transport. Current aggregate CI, Dependency Review, CycloneDX SBOM, SAST Semgrep, and Security Scan associated with that source are terminal-success, but the execution/scanning evidence remains synthetic-merge rather than accepted literal-source proof; the inherited JaCoCo selected bundle still reports zero analyzed production classes; #196 scanner-completeness remains independent; and no qualifying independent non-author formal approval exists. Classification is therefore active_pr via #211, not implemented_on_develop. Keep this issue open until the exact implementation integrates into protected develop and protected acceptance is regenerated.