gnodet-bot commented on code in PR #29705:
URL: https://github.com/apache/camel/pull/29705#discussion_r4550064179
##########
components/camel-zendesk/src/main/java/org/apache/camel/component/zendesk/ZendeskConfiguration.java:
##########
@@ -147,7 +147,15 @@ public boolean equals(Object other) {
public String toString() {
return String.format(
"ZendeskConfiguration:[methodName=%s, serverUrl=%s,
username=%s, password=%s, token=%s, oauthToken=%s]",
- methodName, serverUrl, username, password, token, oauthToken);
+ methodName, serverUrl, username, mask(password), mask(token),
mask(oauthToken));
+ }
+
+ /**
+ * Masks a credential so that logging or a JMX attribute of this
configuration cannot leak it. {@code xxxxxx} is the
+ * mask Camel uses when it sanitizes a URI, and whether the value was set
at all is still visible.
Review Comment:
⚠️ **Contract violation:** `hashCode()` delegates to
`toString().hashCode()`. After this PR, `toString()` masks credentials, so two
configurations differing **only** in credentials (`password`, `token`,
`oauthToken`) will now have equal `toString()` and equal `hashCode()`, while
`equals()` still returns `false`. This breaks the `equals`/`hashCode` contract
in `HashSet`/`HashMap` scenarios.
Consider overriding `hashCode()` with `Objects.hash(...)` using the actual
field values, independent of the masked `toString()` output.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
