Aias00 opened a new issue, #827:
URL: https://github.com/apache/rocketmq-dashboard/issues/827

   ## Problem
   
   `AclUserVO` uses Lombok `@Data` and carries generated ACL credentials 
(`accessKey` and `secretKey`). Lombok includes all fields in the generated 
`toString()` output by default, so accidental VO logging or debug output can 
expose ACL credentials.
   
   ## Evidence
   
   - 
`server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java` 
declares `@Data`.
   - The VO contains `accessKey` and `secretKey` fields.
   - `AclService#createUser` generates and stores real values for both fields 
before returning the saved VO.
   
   ## Expected behavior
   
   Credential fields should be excluded from generated diagnostic output while 
non-sensitive ACL user metadata remains visible.
   
   ## Scope
   
   Small hardening fix for the Studio ACL user management path.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to