ensure Plugin#original_params is obfuscated

Fixes #4952

logstash-core/lib/logstash/config/mixin.rb

@@ -53,7 +53,7 @@ module LogStash::Config::Mixin
     # Keep a copy of the original config params so that we can later
     # differentiate between explicit configuration and implicit (default)
     # configuration.
-    @original_params = params.clone
+    original_params = params.clone
     
     # store the plugin type, turns LogStash::Inputs::Base into 'input'
     @plugin_type = self.class.ancestors.find { |a| a.name =~ /::Base$/ }.config_name
@@ -142,6 +142,11 @@ module LogStash::Config::Mixin
       instance_variable_set("@#{key}", value)
     end
 
+    # now that we know the parameters are valid, we can obfuscate the original copy
+    # of the parameters before storing them as an instance variable
+    self.class.validate_check_parameter_values(original_params)
+    @original_params = original_params
+
     @config = params
   end # def config_init
 

logstash-core/spec/logstash/config/mixin_spec.rb

@@ -96,6 +96,10 @@ describe LogStash::Config::Mixin do
       clone = subject.class.new(subject.params)
       expect(clone.password.value).to(be == secret)
     end
+
+    it "should obfuscate original_params" do
+      expect(subject.original_params['password']).to(be_a(LogStash::Util::Password))
+    end
   end
 
   describe "obsolete settings" do