CREATE DATABASE LINK logs the plaintext password in an INFO schema-cache message

Self Checks

• I have read the Contributing Guide.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

OceanBase version

OceanBase CE 5.0.2.0, source revision d128661ca4f5b3d167c1928e556d70d2f901baef, Release+ASan.

Self Hosted

Self Hosted (Source)

Environment

Ubuntu 22.04.5 LTS, x86_64, one-zone loopback observer, open-source build without OB_BUILD_DBLINK. The target is the closed local port 127.0.0.1:1; no remote connection is opened. Retained logs were mode 0600.

Steps to reproduce

As root@sys on a disposable cluster, execute:

CREATE DATABASE LINK edbf_report_link
  CONNECT TO remote_user@remote_tenant DATABASE test
  IDENTIFIED BY 'EDBF_REPORT_DBLINK_PASSWORD'
  HOST '127.0.0.1:1';

Inspect the INFO-level rootservice log for the schema-cache update. The complete authoritative log is bundled as artifacts/rootservice.log:

add dblinks finish(schemas=[{...,
  encrypted_password:"EDBF_REPORT_DBLINK_PASSWORD",
  host_addr:"127.0.0.1:1", ...}], ret=0)

The relevant logging block is in src/share/schema/ob_server_schema_service.cpp:5303-5333; dblink schema instantiation reaches that block near line 5366. In this tested open-source build, the field named encrypted_password contains the submitted plaintext marker.

artifacts.zip

✔️ Expected Behavior

Passwords must never be rendered by schema objects or schema-cache logging. At most, logs should include the dblink ID/name and non-secret connection metadata.

❌ Actual Behavior

A successful CREATE DATABASE LINK writes the complete plaintext marker at INFO level inside the serialized schema object. This run used root@sys; the minimum SQL privilege was not determined. The result does not claim unprivileged OS access to the mode-0600 log.