Aias00 opened a new issue, #10724:
URL: https://github.com/apache/rocketmq/issues/10724

   ## Problem
   
   `ResponseWriter` logs the full gRPC response object before writing and again 
when the client has cancelled the request. Some proxy responses, especially 
receive-message responses, can carry message payload data. Logging the full 
protobuf response can therefore expose message bodies or other request data in 
proxy logs.
   
   ## Scope
   
   Track 2 / Proxy Admin and gRPC diagnostics hardening. This is a 
logging-safety change only; it should preserve response write behavior.
   
   ## Expected behavior
   
   - Do not log full gRPC response protobuf contents in `ResponseWriter`.
   - Keep useful diagnostics such as response type and status/code when 
available.
   - Add targeted tests to ensure receive-message payload bytes are not present 
in log summaries.
   
   ## Evidence
   
   - 
`proxy/src/main/java/org/apache/rocketmq/proxy/grpc/v2/common/ResponseWriter.java`
 logs `response` directly in debug/warn paths.
   - `ResponseWriter` is used by `ReceiveMessageResponseStreamWriter`, so 
receive responses can pass through this common logging path.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to