...

Currently, the built in file and directory configuration providers used have unrestricted access to files specified by the caller. In security-sensitive environments, the ability to limit the files accessible to these providers when used with Kafka Connect would be beneficial. For example:

...

Classes DirectoryConfigProvider and FileConfigProvider that implements the ConfigProvider interface will be updated. In the configure() method of the classes, the newly added configuration will be retrieved. Their get() method will then verify whether the file it is attempting to access resides within the designated paths. If the file is not within any of the designated paths, ConfigException will be raised. an empty string will be returned for the value. This behaviour is consistent with how EnvVarConfigProvider handles when user attempts to access environment variables that are not allowed.  

In cases where no path is specified, the configuration providers will retain their previous unrestricted access to any file.

This feature will not be useful when using a ConfigProvider in server.properties or in Kafka clients because providers are set in runtime only when used with Kafka Connect. 

Compatibility, Deprecation, and Migration Plan

...