From 7916e2cfd0528a102f16584059fcff381188dce2 Mon Sep 17 00:00:00 2001
From: nishat-06 <nishat@bugqore.com>
Date: Sat, 18 Jul 2026 12:19:19 +0530
Subject: [PATCH] redact obs/oss/cosn/tos/bos secrets in sensitive-config-keys

---
 .../hadoop/fs/CommonConfigurationKeysPublic.java    | 13 +++++++++++++
 .../src/main/resources/core-default.xml             | 13 +++++++++++++
 .../org/apache/hadoop/conf/TestConfigRedactor.java  | 13 +++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java
index 86cad28d3ee33d..d402be7871b135 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java
@@ -1039,6 +1039,19 @@ public class CommonConfigurationKeysPublic {
           "fs.s3a.encryption.key",
           "fs.s3a.encryption.context",
           "fs.azure\\.account.key.*",
+          "fs.obs.secret.key",
+          "fs.obs.session.token",
+          "fs.oss.accessKeySecret",
+          "fs.oss.securityToken",
+          "fs.cosn.userinfo.secretKey",
+          "fs.tos.secret-access-key",
+          "fs.tos.*.secret-access-key",
+          "fs.tos.session-token",
+          "fs.tos.*.session-token",
+          "fs.bos.secret.access.key",
+          "fs.bos.*.secret.access.key",
+          "fs.bos.session.token.key",
+          "fs.bos.*.session.token.key",
           "credential$",
           "oauth.*secret",
           "oauth.*password",
diff --git a/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml b/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
index 2609b1d0f4b346..04bacea38747ee 100644
--- a/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
+++ b/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
@@ -772,6 +772,19 @@
       fs.gs.encryption.*
       fs.gs.proxy.*
       fs.gs.auth.*
+      fs.obs.secret.key
+      fs.obs.session.token
+      fs.oss.accessKeySecret
+      fs.oss.securityToken
+      fs.cosn.userinfo.secretKey
+      fs.tos.secret-access-key
+      fs.tos.*.secret-access-key
+      fs.tos.session-token
+      fs.tos.*.session-token
+      fs.bos.secret.access.key
+      fs.bos.*.secret.access.key
+      fs.bos.session.token.key
+      fs.bos.*.session.token.key
       credential$
       oauth.*secret
       oauth.*password
diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/conf/TestConfigRedactor.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/conf/TestConfigRedactor.java
index a59db14e235725..0dd45497208832 100644
--- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/conf/TestConfigRedactor.java
+++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/conf/TestConfigRedactor.java
@@ -72,6 +72,19 @@ private void testRedact(Configuration conf) throws Exception {
         "ssl.server.keystore.keypassword",
         "ssl.server.keystore.password",
         "httpfs.ssl.keystore.pass",
+        "fs.obs.secret.key",
+        "fs.obs.session.token",
+        "fs.oss.accessKeySecret",
+        "fs.oss.securityToken",
+        "fs.cosn.userinfo.secretKey",
+        "fs.tos.secret-access-key",
+        "fs.tos.bucket.BUCKET.secret-access-key",
+        "fs.tos.session-token",
+        "fs.tos.bucket.BUCKET.session-token",
+        "fs.bos.secret.access.key",
+        "fs.bos.bucket.BUCKET.secret.access.key",
+        "fs.bos.session.token.key",
+        "fs.bos.bucket.BUCKET.session.token.key",
         "hadoop.security.sensitive-config-keys"
     );
     for (String key : sensitiveKeys) {