Refactor/simplify v4 - #9
Merged
Merged
Conversation
…nd_index The emit_log_hook masking regex was missing v4.0 function names: - encrypt.register_key() - leaked DEK and passphrase in STATEMENT/CONTEXT - encrypt.blind_index() - leaked HMAC key in STATEMENT/CONTEXT This allowed secrets to appear in PostgreSQL logs when validation errors occurred (e.g., "encryption key must be at least 16 bytes"). Fix: Added register_key and blind_index to the regex alternation group in suppress_keylog_hook(). Also updated: - CLAUDE.md: Added "Log Masking for Sensitive Functions" section with contributor guidance for adding new sensitive functions - CHANGELOG.md: Documented the security fix Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ery_literals INSERT/UPDATE statements with plaintext values in encrypted columns leak to PostgreSQL logs. Document the encrypt.mask_query_literals GUC which masks ALL string literals when enabled. Updates: - README.md: Added Step 2.5 explaining when/why to enable mask_query_literals - CLAUDE.md: Added detailed section on INSERT/UPDATE data masking with trade-offs, best practices, and alternative approaches - CHANGELOG.md: Added documentation entry Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves the extension’s log-leak protections and contributor/user guidance by documenting literal-masking and expanding the emit_log_hook masking regex to cover v4 API calls that accept secrets.
Changes:
- Document
encrypt.mask_query_literalsusage (session/global) and its trade-offs (README, CLAUDE.md). - Extend
suppress_keylog_hookregex masking to includeregister_keyandblind_index(plus explanatory comment) incolumn_encrypt.c. - Update the changelog to record the log-masking documentation and the security fix.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| README.md | Adds a usage step recommending enabling encrypt.mask_query_literals to prevent plaintext literal leakage in logs. |
| column_encrypt.c | Updates the log-masking regex to include v4+ sensitive functions (register_key, blind_index) and documents the intent inline. |
| CLAUDE.md | Adds contributor-focused guidance on which functions must be masked and how to extend/test masking. |
| CHANGELOG.md | Records the documentation additions and the security fix for masking v4 API calls. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Describe the problem and the fix clearly and briefly.
Maintainer: Vibhor Kumar