davsclaus commented on code in PR #25093:
URL: https://github.com/apache/camel/pull/25093#discussion_r3646022374
##########
dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/McpSecurityInterceptor.java:
##########
@@ -84,11 +86,17 @@ Object intercept(InvocationContext ctx) throws Exception {
try {
Object result = ctx.proceed();
- // Secret redaction on string results
- if (config.isRedactionEnabled() && result instanceof String s) {
- if (redactor.containsSecret(s)) {
- result = redactor.redact(s);
- wasRedacted = true;
+ // Secret redaction. Free-text (String) results go through the
regex redactor; structured results
+ // (Map/List, such as the JsonObject returned by the runtime
tools) are scrubbed by key name in place,
+ // which is what catches JSON-quoted values the value regex cannot
match.
+ if (config.isRedactionEnabled() && result != null) {
+ if (result instanceof String s) {
+ if (redactor.containsSecret(s)) {
+ result = redactor.redact(s);
+ wasRedacted = true;
+ }
+ } else if (result instanceof Map<?, ?> || result instanceof
List<?>) {
Review Comment:
Minor: `containsSecret(s)` now internally calls `redact(s)` and discards the
result, then `redact(s)` is called again here. Could be simplified to:
```suggestion
if (result instanceof String s) {
String scrubbed = redactor.redact(s);
if (!scrubbed.equals(s)) {
result = scrubbed;
wasRedacted = true;
}
```
This avoids running the full masking pipeline twice for strings that contain
secrets.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
