AWS - [Security] Don't throw exception with secret value in message

secret-provider/src/main/scala/io/lenses/connect/secrets/providers/AWSHelper.scala

@@ -5,6 +5,7 @@
  */
 
 package io.lenses.connect.secrets.providers
+import com.fasterxml.jackson.core.JsonParseException
 import com.fasterxml.jackson.databind.ObjectMapper
 import com.typesafe.scalalogging.LazyLogging
 import com.typesafe.scalalogging.StrictLogging
@@ -122,6 +123,8 @@ class AWSHelper(
       )
     } yield mapFromResponse
     a match {
+      case Failure(_: JsonParseException) =>
+        Left(new IllegalStateException(s"Unable to parse JSON in secret [$secretId}]"))
       case Failure(exception) => Left(exception)
       case Success(value)     => Right(value)
     }

secret-provider/src/main/scala/io/lenses/connect/secrets/providers/VaultHelper.scala

@@ -38,10 +38,9 @@ class VaultHelper(
 ) extends SecretHelper
     with LazyLogging {
 
-
   override def lookup(path: String): Either[Throwable, ValueWithTtl[Map[String, String]]] = {
     logger.debug(s"Looking up value from Vault at [$path]")
-    val lookupFn = if (path.startsWith("database/creds/"))  lookupFromDatabaseEngine _  else lookupFromVault _
+    val lookupFn = if (path.startsWith("database/creds/")) lookupFromDatabaseEngine _ else lookupFromVault _
     lookupFn(path) match {
       case Left(ex) =>
         failWithEx(s"Failed to fetch secrets from path [$path]", ex)
@@ -60,13 +59,16 @@ class VaultHelper(
     }
   }
 
-  private def lookupFromVault(path: String): Either[Throwable, LogicalResponse] = {
+  private def lookupFromVault(path: String): Either[Throwable, LogicalResponse] =
     Try(vaultClient.logical().read(path)).toEither
-  }
 
   private def lookupFromDatabaseEngine(path: String): Either[Throwable, LogicalResponse] = {
     val parts = path.split("/")
-    Either.cond(parts.length == 3, vaultClient.database().creds(parts(2)), new ConnectException("Database path is invalid. Path must be in the form 'database/creds/<role_name>'"))
+    Either.cond(
+      parts.length == 3,
+      vaultClient.database().creds(parts(2)),
+      new ConnectException("Database path is invalid. Path must be in the form 'database/creds/<role_name>'"),
+    )
   }
 
   private def parseSuccessfulResponse(

secret-provider/src/test/scala/io/lenses/connect/secrets/providers/AWSSecretProviderTest.scala

@@ -25,6 +25,7 @@ import software.amazon.awssdk.services.secretsmanager.SecretsManagerClient
 import software.amazon.awssdk.services.secretsmanager.model._
 
 import java.nio.file.FileSystems
+import java.time.Instant
 import java.time.temporal.ChronoUnit
 import java.util.Base64
 import java.util.Date
@@ -328,4 +329,47 @@ class AWSSecretProviderTest extends AnyWordSpec with Matchers with MockitoSugar
     data.data().get("mykey") shouldBe secretValue
     provider.close()
   }
+
+  "should not throw exception with secret value in message" in {
+    val props = Map(
+      AWSProviderConfig.AUTH_METHOD    -> AuthMode.CREDENTIALS.toString,
+      AWSProviderConfig.AWS_ACCESS_KEY -> "somekey",
+      AWSProviderConfig.AWS_SECRET_KEY -> "secretkey",
+      AWSProviderConfig.AWS_REGION     -> "someregion",
+    ).asJava
+
+    val secretKey   = "my-secret-key"
+    val secretName  = "my-secret-name"
+    val secretValue = "secret-value"
+
+    val mockClient = mock[SecretsManagerClient]
+    val secretValRequest =
+      GetSecretValueRequest.builder().secretId(secretName).build()
+
+    // Not json, just the string - so should cause json parse exception
+    val secretValResponse = GetSecretValueResponse.builder().name(secretName).secretString(secretValue).build()
+    val now               = Instant.now()
+    val rotationRulesType = RotationRulesType.builder().automaticallyAfterDays(1L).build()
+
+    val describeSecretResponse = DescribeSecretResponse.builder().lastRotatedDate(now).rotationEnabled(
+      true,
+    ).lastRotatedDate(now).rotationRules(rotationRulesType).nextRotationDate(now).build()
+
+    when(mockClient.describeSecret(any[DescribeSecretRequest]))
+      .thenReturn(describeSecretResponse)
+    when(mockClient.getSecretValue(secretValRequest))
+      .thenReturn(secretValResponse)
+
+    Using.resource {
+      val prov = new AWSSecretProvider(Some(mockClient))
+      prov.configure(props)
+      prov
+    } {
+      sp =>
+        intercept[Exception] {
+          sp.get(secretName, Set(secretKey).asJava)
+        }.getMessage should not include secretValue
+    }(_.close())
+
+  }
 }

secret-provider/src/test/scala/io/lenses/connect/secrets/providers/VaultHelperTest.scala

@@ -34,15 +34,15 @@ class VaultHelperTest
 
   private val validResponse: LogicalResponse = {
     val sampleResponseData: JavaMap[String, String] = Map("key1" -> "value1", "key2" -> "value2").asJava
-    val sampleResponse: LogicalResponse = mock[LogicalResponse](Answers.RETURNS_DEEP_STUBS)
+    val sampleResponse:     LogicalResponse         = mock[LogicalResponse](Answers.RETURNS_DEEP_STUBS)
     when(sampleResponse.getData).thenReturn(sampleResponseData)
     when(sampleResponse.getRestResponse.getStatus).thenReturn(200)
     sampleResponse
   }
 
   private val validDatabaseResponse: DatabaseResponse = {
     val sampleResponseData: JavaMap[String, String] = Map("key1" -> "value1", "key2" -> "value2").asJava
-    val sampleResponse: DatabaseResponse = mock[DatabaseResponse](Answers.RETURNS_DEEP_STUBS)
+    val sampleResponse:     DatabaseResponse        = mock[DatabaseResponse](Answers.RETURNS_DEEP_STUBS)
     when(sampleResponse.getData).thenReturn(sampleResponseData)
     when(sampleResponse.getRestResponse.getStatus).thenReturn(200)
     sampleResponse
@@ -85,7 +85,7 @@ class VaultHelperTest
   }
 
   test("VaultHelper.lookup should handle secrets not found at the specified path") {
-    val vaultClient:      Vault           = mock[Vault](Answers.RETURNS_DEEP_STUBS)
+    val vaultClient: Vault = mock[Vault](Answers.RETURNS_DEEP_STUBS)
     when(vaultClient.logical().read("empty/path")).thenReturn(notFoundResponse)
 
     val vaultHelper: VaultHelper = new VaultHelper(vaultClient, Some(defaultTtl), fileWriterCreateFn)(clock)