SET ENCRYPTION and SET DECRYPTION write plaintext passphrases to INFO logs

Self Checks

• I have read the Contributing Guide.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

OceanBase version

OceanBase CE 5.0.2.0, source revision d128661ca4f5b3d167c1928e556d70d2f901baef, Release+ASan.

Self Hosted

Self Hosted (Source)

Environment

Ubuntu 22.04.5 LTS, Linux 6.5.13-5-pve x86_64, one-zone loopback observer. The observer/rootservice log files produced by this run were mode 0600.

Steps to reproduce

Run as root@sys on a disposable instance and use synthetic values:

SET ENCRYPTION ON IDENTIFIED BY 'EDBF_REPORT_ENCRYPTION_SECRET' ONLY;
SET DECRYPTION IDENTIFIED BY 'EDBF_REPORT_DECRYPTION_SECRET';
SELECT VERSION(), CURRENT_USER();

Then inspect the packaged authoritative artifacts/observer.log (or the new run's observer.log) at INFO level:

INFO [SQL.RESV] resolve set encryption(mode=1,
  passwd=EDBF_REPORT_ENCRYPTION_SECRET)

INFO [COMMON] add passwd(passwd=EDBF_REPORT_DECRYPTION_SECRET,
  encrypted_passwd=<hash>, passwd_array="<hash>")

The source sinks are:

src/sql/resolver/cmd/ob_alter_system_resolver.cpp:6511
  LOG_INFO("resolve set encryption", K(mode), K(passwd));

src/sql/resolver/cmd/ob_alter_system_stmt.cpp:110
  COMMON_LOG(INFO, "add passwd", K(passwd), K(encrypted_passwd), K_(passwd_array));

The fixed control (SELECT 1) contained neither sentinel. Both SQL statements succeeded, both post-statement probes found their corresponding plaintext sentinel, and the health query passed.

✔️ Expected Behavior

Passphrases supplied to encryption/decryption administration statements must never be written to diagnostic logs. A log may record the operation, mode, result code, and a redacted value.

❌ Actual Behavior

Both plaintext passphrases are emitted at INFO level. A copied log, support bundle, backup, or operator with access to the OceanBase service account's logs can recover them.

The run demonstrated secret presence in mode-0600 files. It did not demonstrate unprivileged OS read access, privilege escalation, or reuse of the synthetic values. Maintainer confirmation and least-privilege SQL analysis remain pending.