fix(cdc): prevent replication probe diagnostic leakage

[seonghobae]

Purpose

Fix the protected CDC replication-slot status confidentiality defect test-first. ReplicationSlotProbe historically returned DataAccessException driver text in the operator-facing status payload and wrote e.toString() to debug logs. Database drivers can embed connection coordinates, usernames, URL parameters, SQL/provider diagnostics, or other deployment-sensitive material in those messages.

This remains a direct-develop, path-disjoint Draft. It changes only the replication-slot probe and focused regression test. Nothing here is implemented_on_develop before protected integration.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/replication-slot-probe-safe-errors-622e5e6;
• fail-first head: 6495f70b8cff7b41b29175b841f79d79a92791dd;
• exact current source head: f056afbd79567a7a5276170b02090fcbc7eab493;
• current synthetic merge preview: 14eb75f4e5ff9b51af1c9c3e24b9b07dc658bf70;
• exact live-base comparison: 2 commits ahead, 0 behind, merge base = protected develop;
• GitHub mergeability: true;
• Draft: true.

Every predecessor-head/base check or review is historical and does not transfer.

RCA

• Immediate cause: probeSlot(...) placed exception-derived text into the status response and debug log.
• Technical root cause: an availability-classification boundary was coupled to low-level database diagnostic transport. Length limiting did not remove credentials or connection strings.
• Control failure: the old failure test verified only available=false / query_failed, not confidentiality of the returned/logged diagnostic.

RED → GREEN

Fail-first 6495f70b8cff7b41b29175b841f79d79a92791dd injects a realistic PostgreSQL-style diagnostic containing a JDBC URL, username and password-like parameter and requires the public result to contain only Replication slot state unavailable with no JDBC URL/secret.

Exact current source head f056afbd79567a7a5276170b02090fcbc7eab493 applies the smallest root-cause repair:

• public/status failure remains available=false, found=false, error=query_failed;
• response message is a stable bounded Replication slot state unavailable;
• ordinary debug logging records only stable query_failed classification;
• driver exception text/stack, connection string and credentials are not transported;
• slot selection, successful row parsing and availability semantics are unchanged;
• touched public constructor/method behavior has beginner-readable Javadoc.

Current hosted evidence

For exact source head f056afbd79567a7a5276170b02090fcbc7eab493 all exposed pull-request aggregates are terminal-success:

• SAST Semgrep 31342557793: success;
• CycloneDX SBOM 31342557768: success;
• Dependency Review 31342557801: success;
• CI 31342557781: success;
• Security Scan 31342557778: success.

This is not merge authorization. Current protected PR workflows execute GitHub's synthetic merge preview rather than accepted literal source, protected JaCoCo can still report a vacuous zero-class bundle until #162/#164 integrates, and issue #196 requires Maven vulnerability evidence to fail closed when Trivy says BOM-managed dependency resolution is incomplete. Those evidence dimensions are independent of this two-file confidentiality behavior.

A fresh CodeRabbit review was explicitly requested for this exact head after the historical Draft skip. Reviewer/provider latency blocks only that review lane and is not interpreted as approval.

Documentation / traceability boundary

#159 tracks canonical diagnostic-confidentiality reconciliation. Active PR #174 carries broader CDC diagnostic-confidentiality doctoring covering row IDs, DDL, parser/driver diagnostics, purpose-bound observability, CWE-532 and OWASP Logging Cheat Sheet guidance. That active-PR artifact is not shipped truth and does not transfer merge evidence to this branch; do not duplicate canonical prose into this bounded probe repair merely to increase file count.

Merge boundary

Keep Draft. Merge only when the unchanged exact source head has accepted literal-source deterministic/security evidence, complete same-revision dependency/vulnerability evidence, non-vacuous owned-production coverage, zero valid unresolved findings, every required repository/security gate, and qualifying independent non-author formal approval where governance requires it. No predecessor-head, other-PR, incomplete-scanner, status-only, skipped-required or synthetic-merge-only evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c52d77d7-f54f-42c6-aef6-40976adc66fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.