RockteMQ-AI commented on issue #10716:
URL: https://github.com/apache/rocketmq/issues/10716#issuecomment-5141740960
**Issue Evaluation**
Category: `type/bug` | Status: **Confirmed**
Verified against the current codebase on `develop` branch.
**Root Cause:** `ClientActivity` logs the full `Settings` protobuf when
saving client settings synced from another proxy:
- Line ~600: `log.debug("save client settings sync from other proxy.
group:{}, channelInfo:{}, settings:{}", group, clientChannelInfo, settings)`
Although this is at `debug` level, the full `Settings` protobuf can contain
detailed publish/subscription metadata and should not be dumped even at debug
level in production diagnostics.
**Impact:** Information leakage through debug logs. In environments with
debug logging enabled, full Settings are written for every cross-proxy sync
event.
**Severity:** low-medium — debug-level reduces exposure, but diagnostic logs
should still use compact summaries.
**Suggested Fix:** Replace `settings` in the log with a compact summary
(e.g., client type, subscription count, attribute length).
---
*Automated evaluation by github-manager-bot*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
