azure-event-hubs-spark
azure-event-hubs-spark copied to clipboard
Insecure and redundant encryption for Eventhub connection string
In the PR #491 connection string is encrypted using the library version as a key for AES algorithm. So it's completely insecure, as everybody can decrypt the value. Hence applied fix does not solve the initial issue, but just hides it.
Also by forcing library consumers for encrypting the connection string, it adds additional troubles when using this library under .NET for Apache Spark (a.k.a .net backend), where it's not possible to directly access JVM methods.
To be precise, the following code doesn't work in .NET backend for Spark:
sc._jvm.org.apache.spark.eventhubs.EventHubsUtils.encrypt(connectionString)
So that it forces to re-implement encrypt logic in .NET (and other spark backends), which is quite odd..
My view is that the correct fix would be to apply changes for Spark runtime, so that spark itself should not log sensitive content.