out_stackdriver: out_bigquery: out_chronicle: conceal jwt token on debug logs

[cosmo0920]

Mitigated all three outputs: Stackdriver, BigQuery, and Chronicle now log only JWT assertion generated, without credential contents. Added six regression cases covering debug and trace logging.

Verification:

• Build passed.
• Selected Stackdriver and Chronicle runtime tests passed; the Chronicle suite passed. The Stackdriver suite exceeded the 20-second test limit.
• Both integration commands below were attempted, but local socket creation failed with Operation not permitted. Valgrind verification therefore remains incomplete.

tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_stackdriver -q
VALGRIND=1 VALGRIND_STRICT=1 tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_stackdriver -q

Can you approve local-socket test execution when approval is available? Automatic approval review failed twice because its model was at capacity, leaving these checks blocked.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • Debug and trace logs for BigQuery, Chronicle, and Stackdriver no longer include the contents of OAuth signed assertions, which could be replayed as credentials. Logs instead indicate that an assertion was generated, reducing the risk of sensitive credential exposure. Integration coverage verifies that assertion contents are absent from logs.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T04:23:37.629651Z	3ce94ba	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

📝 Walkthrough

The BigQuery, Chronicle, and Stackdriver plugins no longer log OAuth JWT assertion contents. An integration test checks their logs at debug and trace levels and records an attempted connection to Google OAuth through a local rejecting proxy.

Changes: OAuth assertion log redaction

Layer / File(s)	Summary
Redact assertion logs and verify plugin behavior plugins/out_bigquery/bigquery.c, plugins/out_chronicle/chronicle.c, plugins/out_stackdriver/stackdriver.c, tests/integration/scenarios/out_stackdriver/tests/test_assertion_logging.py	The three plugins replace assertion-content logs with a message that an assertion was generated. The integration test checks for assertion text in logs and verifies that the proxy recorded a connection to Google OAuth.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: 🔵 Low · up to 3ce94

The assertion redaction change appears mergeable with awareness that the new proxy-based tests have not completed locally. An unrelated log value could make the JWT check fail, though that has not been shown for these test runs.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the three affected outputs and the main change: preventing JWT assertion contents from appearing in debug logs.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3ce94ba306

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

🔇 Additional comments: 4

plugins/out_bigquery/bigquery.c: 1

254-255: LGTM!

plugins/out_chronicle/chronicle.c: 1

219-220: LGTM!

plugins/out_stackdriver/stackdriver.c: 1

426-427: LGTM!

tests/integration/scenarios/out_stackdriver/tests/test_assertion_logging.py-86-86: 1

86-86: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

The JWT regex can match unrelated log text and cause flaky failures.

The pattern [A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{20,} matches any dotted token with a long final segment. Examples are hostnames, file paths, and version strings. Debug and trace logs contain such text. The test can then fail without any assertion leak.

Anchor the pattern on the JWT header prefix. Every JWT built by these plugins starts with the base64 of {"alg": "RS256", "typ": "JWT"}. That prefix is eyJhbGciOiAiUlMyNTYi.

Proposed fix

-    assert not re.search(r"[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{20,}", logs)
+    assert not re.search(r"eyJhbGciOiAiUlMyNTYi[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+", logs)

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6df8d5cc-b8b3-4dc5-88c5-ca7900068651

📥 Commits

Reviewing files that changed from the base of the PR and between b43b6a6 and 3ce94ba.

📒 Files selected for processing: 4

• plugins/out_bigquery/bigquery.c
• plugins/out_chronicle/chronicle.c
• plugins/out_stackdriver/stackdriver.c
• tests/integration/scenarios/out_stackdriver/tests/test_assertion_logging.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.