LuciferYang opened a new issue, #13218:
URL: https://github.com/apache/gravitino/issues/13218
### Version
main branch
### Describe what's wrong
Lombok `@ToString` renders `accessToken` and `refreshToken` (bearer
credentials) on `OAuth2TokenResponse`, and the whole secrets map on
`SecretsResponse`, in plaintext. Any log statement that prints these response
objects leaks secret material.
### Error message and/or stacktrace
N/A. Secret material leaks into log output; no exception is thrown.
### How to reproduce
Log an `OAuth2TokenResponse` or `SecretsResponse` instance (for example
`log.info("{}", response)`); the bearer tokens and the secrets appear in
plaintext in the log.
### Additional context
`SecretBindingDTO` already excludes its plaintext from `toString()` the same
way. Found during a review of the `common` module.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
