RockteMQ-AI commented on issue #10720:
URL: https://github.com/apache/rocketmq/issues/10720#issuecomment-5141740474
**Issue Evaluation**
Category: `type/bug` | Status: **Confirmed**
Verified against the current codebase on `develop` branch.
**Root Cause:** `GrpcClientChannel` logs the raw `Settings` protobuf object
on conversion failure in two places:
- `toChannelExtendAttribute()` (line ~91): `log.error("convert settings to
json data failed. settings:{}", settings, e)`
- `parseChannelExtendAttribute()` (line ~109): `log.error("convert settings
json data to settings failed. data:{}", attr, e)`
The `Settings` protobuf can contain detailed publishing/subscription
metadata. On conversion failure, the full object is dumped to the error log.
**Impact:** Potential information leakage through logs. Serialized Settings
may include topic names, consumer group details, and subscription
configurations.
**Severity:** medium — no functional impact, but diagnostic logs should use
compact summaries (client type, counts, attribute length) instead of raw
protobuf output.
**Suggested Fix:** Replace raw `settings` / `attr` in log messages with a
compact diagnostic summary (e.g., client type, pub/sub counts, attribute string
length).
---
*Automated evaluation by github-manager-bot*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
