Add configuration hide-user-data-from-log to hide user data from server logs

[naglera]

Implement data masking for user data in server logs and diagnostic output. This change prevents potential exposure of confidential information, such as PII, and enhances privacy protection. It masks all command arguments, client names, and client usernames.

Added a new hide-user-data-from-log configuration item, default yes.

[codecov]

Codecov Report

Attention: Patch coverage is 27.58621% with 21 lines in your changes missing coverage. Please review.

Project coverage is 70.42%. Comparing base (04d76d8) to head (f8e62fe).
Report is 25 commits behind head on unstable.

Files with missing lines	Patch %	Lines
src/debug.c	0.00%	19 Missing ⚠️
src/replication.c	66.66%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           unstable     #877      +/-   ##
============================================
- Coverage     70.43%   70.42%   -0.02%     
============================================
  Files           113      114       +1     
  Lines         61728    61647      -81     
============================================
- Hits          43479    43413      -66     
+ Misses        18249    18234      -15     

Files with missing lines	Coverage Δ
src/acl.c	88.89% <100.00%> (ø)
src/config.c	78.69% <ø> (ø)
src/networking.c	88.34% <100.00%> (-0.04%)	⬇️
src/server.h	100.00% <ø> (ø)
src/replication.c	87.13% <66.66%> (+0.01%)	⬆️
src/debug.c	53.67% <0.00%> (-0.65%)	⬇️

... and 25 files with indirect coverage changes

[madolson]

In the client info we have two extra pieces of information, the name and the user, we need to decide if this counts as user data and should also be redacted from the log.

[madolson]

@valkey-io/core-team Overall would like a vote for this. In addition, some specific questions for this feature:

1. What should the config name be. My recommendation is hide-user-data-in-log
2. Is the user and name attached a client considered highly sensitive data and we should avoid logging. We marked the username as sensitive here: 3c0fd25.

If we don't believe users should be logged, we should also hide them from the client list output that is also in the log.

[PingXie]

1. What should the config name be. My recommendation is hide-user-data-in-log

If Redis has already picked this name and the behavior is similar, I think this name is good (so users don't have to learn a new concept).

Though from a quick look at the PR, we also use this config to decide whether to log the stack trace, which makes "user-data" a bit far fetched IMO - just a nit.

[hwware]

@valkey-io/core-team Overall would like a vote for this. In addition, some specific questions for this feature:

1. What should the config name be. My recommendation is hide-user-data-in-log
2. Is the user and name attached a client considered highly sensitive data and we should avoid logging. We marked the username as sensitive here: 3c0fd25.

If we don't believe users should be logged, we should also hide them from the client list output that is also in the log.

1. hide-user-data-in-log is fine for me, and it aligns to Redis
2. username can be sensitive data, please reference function isSensitiveCommand (valkey-cli.c), which username, passpword, and sentinel-user are all sensitive

[madolson]

username can be sensitive data, please reference function isSensitiveCommand (valkey-cli.c), which username, passpword, and sentinel-user are all sensitive

I'm aligned with this. Let's remove the name and username from the client output as well.

[naglera]

When it comes to masking the client's name and username from the client output, should we apply it to all instances where client information is printed, or only to the cases where the server voluntarily reveals such details?
i.e. should client list and client info work normaly when feature is enabeld?
@hwware @madolson

[madolson]

@naglera I think a bunch of tests are failing because we changed the default value, which is breaking a bunch of log scans for tests. I think for testing we can default to having it on.

[enjoy-binbin]

The new code LGTM.

[ranshid]

LGTM