This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 056a82bc fix: redact credentials from diagnostic output (#928)
056a82bc is described below
commit 056a82bc3c4d1ac9e4118f3fa92f459aa3cf640f
Author: aias00 <[email protected]>
AuthorDate: Tue Aug 4 03:04:23 2026 -0700
fix: redact credentials from diagnostic output (#928)
* [ISSUE #819] Redact user password in toString
* [ISSUE #821] Redact datasource test credentials in toString
* [ISSUE #823] Redact login password in toString
* [ISSUE #825] Redact login token in toString
* [ISSUE #827] Redact ACL user credentials in toString
* [ISSUE #838] Redact settings JSON from toString
---
.../org/apache/rocketmq/studio/auth/LoginDTO.java | 2 ++
.../org/apache/rocketmq/studio/auth/LoginVO.java | 2 ++
.../rocketmq/studio/instance/acl/AclUserVO.java | 3 ++
.../org/apache/rocketmq/studio/model/User.java | 2 +-
.../studio/persistence/entity/RmqSettings.java | 2 ++
.../studio/settings/DataSourceTestDTO.java | 3 ++
.../apache/rocketmq/studio/auth/LoginDTOTest.java} | 34 ++++++++----------
.../apache/rocketmq/studio/auth/LoginVOTest.java} | 40 ++++++++++-----------
.../studio/instance/acl/AclUserVOTest.java} | 40 ++++++++++++---------
.../apache/rocketmq/studio/model/UserTest.java} | 33 +++++++----------
.../persistence/entity/RmqSettingsTest.java} | 27 ++++++++------
.../studio/settings/DataSourceTestDTOTest.java} | 41 ++++++++++++----------
12 files changed, 122 insertions(+), 107 deletions(-)
diff --git a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginDTO.java
b/server/src/main/java/org/apache/rocketmq/studio/auth/LoginDTO.java
index cd534770..d2ae6150 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginDTO.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/LoginDTO.java
@@ -18,9 +18,11 @@
package org.apache.rocketmq.studio.auth;
import lombok.Data;
+import lombok.ToString;
@Data
public class LoginDTO {
private String username;
+ @ToString.Exclude
private String password;
}
diff --git a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
b/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
index 686ec392..98bb105c 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
@@ -21,12 +21,14 @@ import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;
+import lombok.ToString;
@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
public class LoginVO {
+ @ToString.Exclude
private String token;
private int expiresIn;
private UserInfo user;
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java
index 9e917848..2c51c4f8 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java
@@ -20,6 +20,7 @@ import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;
+import lombok.ToString;
import java.time.LocalDateTime;
import java.util.List;
@@ -31,7 +32,9 @@ import java.util.List;
public class AclUserVO {
private String id;
private String username;
+ @ToString.Exclude
private String accessKey;
+ @ToString.Exclude
private String secretKey;
private boolean admin;
private List<String> clusters;
diff --git a/server/src/main/java/org/apache/rocketmq/studio/model/User.java
b/server/src/main/java/org/apache/rocketmq/studio/model/User.java
index 020aed11..6844d093 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/model/User.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/model/User.java
@@ -76,7 +76,7 @@ public class User {
return "User{" +
"id=" + id +
", name='" + name + '\'' +
- ", password='" + password + '\'' +
+ ", password='******'" +
", type=" + type +
'}';
}
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqSettings.java
b/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqSettings.java
index 696f7d73..270f5e73 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqSettings.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqSettings.java
@@ -20,6 +20,7 @@ import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableId;
import com.baomidou.mybatisplus.annotation.TableName;
import lombok.Data;
+import lombok.ToString;
import java.time.LocalDateTime;
@@ -30,6 +31,7 @@ public class RmqSettings {
@TableId(type = IdType.ASSIGN_UUID)
private String id;
+ @ToString.Exclude
private String json;
private LocalDateTime updatedAt;
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/settings/DataSourceTestDTO.java
b/server/src/main/java/org/apache/rocketmq/studio/settings/DataSourceTestDTO.java
index ecfba0ec..26020877 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/settings/DataSourceTestDTO.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/settings/DataSourceTestDTO.java
@@ -21,6 +21,7 @@ import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;
+import lombok.ToString;
@Data
@Builder
@@ -33,6 +34,8 @@ public class DataSourceTestDTO {
private String type;
private String auth;
private String username;
+ @ToString.Exclude
private String password;
+ @ToString.Exclude
private String bearerToken;
}
diff --git a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
b/server/src/test/java/org/apache/rocketmq/studio/auth/LoginDTOTest.java
similarity index 65%
copy from server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
copy to server/src/test/java/org/apache/rocketmq/studio/auth/LoginDTOTest.java
index 686ec392..2316991c 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
+++ b/server/src/test/java/org/apache/rocketmq/studio/auth/LoginDTOTest.java
@@ -14,29 +14,23 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-
package org.apache.rocketmq.studio.auth;
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class LoginDTOTest {
+
+ @Test
+ void toStringShouldNotExposePassword() {
+ LoginDTO request = new LoginDTO();
+ request.setUsername("admin");
+ request.setPassword("plain-secret");
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class LoginVO {
- private String token;
- private int expiresIn;
- private UserInfo user;
+ String value = request.toString();
- @Data
- @Builder
- @NoArgsConstructor
- @AllArgsConstructor
- public static class UserInfo {
- private String username;
- private boolean admin;
+ assertThat(value).contains("username=admin");
+ assertThat(value).doesNotContain("plain-secret");
}
}
diff --git a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
b/server/src/test/java/org/apache/rocketmq/studio/auth/LoginVOTest.java
similarity index 56%
copy from server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
copy to server/src/test/java/org/apache/rocketmq/studio/auth/LoginVOTest.java
index 686ec392..db8b63b4 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
+++ b/server/src/test/java/org/apache/rocketmq/studio/auth/LoginVOTest.java
@@ -14,29 +14,29 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-
package org.apache.rocketmq.studio.auth;
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class LoginVOTest {
+
+ @Test
+ void toStringShouldNotExposeToken() {
+ LoginVO response = LoginVO.builder()
+ .token("studio-jwt-secret")
+ .expiresIn(3600)
+ .user(LoginVO.UserInfo.builder()
+ .username("admin")
+ .admin(true)
+ .build())
+ .build();
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class LoginVO {
- private String token;
- private int expiresIn;
- private UserInfo user;
+ String value = response.toString();
- @Data
- @Builder
- @NoArgsConstructor
- @AllArgsConstructor
- public static class UserInfo {
- private String username;
- private boolean admin;
+ assertThat(value).contains("expiresIn=3600");
+ assertThat(value).contains("username=admin");
+ assertThat(value).doesNotContain("studio-jwt-secret");
}
}
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclUserVOTest.java
similarity index 54%
copy from
server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java
copy to
server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclUserVOTest.java
index 9e917848..facbec71 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclUserVOTest.java
@@ -16,24 +16,30 @@
*/
package org.apache.rocketmq.studio.instance.acl;
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
+import org.junit.jupiter.api.Test;
-import java.time.LocalDateTime;
import java.util.List;
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class AclUserVO {
- private String id;
- private String username;
- private String accessKey;
- private String secretKey;
- private boolean admin;
- private List<String> clusters;
- private LocalDateTime createdAt;
+import static org.assertj.core.api.Assertions.assertThat;
+
+class AclUserVOTest {
+
+ @Test
+ void toStringShouldNotExposeCredentials() {
+ AclUserVO user = AclUserVO.builder()
+ .id("user-1")
+ .username("ops-admin")
+ .accessKey("plain-access-key")
+ .secretKey("plain-secret-key")
+ .admin(true)
+ .clusters(List.of("prod"))
+ .build();
+
+ String value = user.toString();
+
+ assertThat(value).contains("username=ops-admin");
+ assertThat(value).contains("admin=true");
+ assertThat(value).doesNotContain("plain-access-key");
+ assertThat(value).doesNotContain("plain-secret-key");
+ }
}
diff --git a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
b/server/src/test/java/org/apache/rocketmq/studio/model/UserTest.java
similarity index 62%
copy from server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
copy to server/src/test/java/org/apache/rocketmq/studio/model/UserTest.java
index 686ec392..37a0d522 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/LoginVO.java
+++ b/server/src/test/java/org/apache/rocketmq/studio/model/UserTest.java
@@ -14,29 +14,22 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
+package org.apache.rocketmq.studio.model;
-package org.apache.rocketmq.studio.auth;
+import org.junit.jupiter.api.Test;
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
+import static org.assertj.core.api.Assertions.assertThat;
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class LoginVO {
- private String token;
- private int expiresIn;
- private UserInfo user;
+class UserTest {
- @Data
- @Builder
- @NoArgsConstructor
- @AllArgsConstructor
- public static class UserInfo {
- private String username;
- private boolean admin;
+ @Test
+ void toStringShouldNotExposePassword() {
+ User user = new User("admin", "plain-secret", User.SUPER);
+
+ String value = user.toString();
+
+ assertThat(value).contains("name='admin'");
+ assertThat(value).contains("password='******'");
+ assertThat(value).doesNotContain("plain-secret");
}
}
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqSettings.java
b/server/src/test/java/org/apache/rocketmq/studio/persistence/entity/RmqSettingsTest.java
similarity index 56%
copy from
server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqSettings.java
copy to
server/src/test/java/org/apache/rocketmq/studio/persistence/entity/RmqSettingsTest.java
index 696f7d73..a5e0f2c4 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqSettings.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/persistence/entity/RmqSettingsTest.java
@@ -16,21 +16,26 @@
*/
package org.apache.rocketmq.studio.persistence.entity;
-import com.baomidou.mybatisplus.annotation.IdType;
-import com.baomidou.mybatisplus.annotation.TableId;
-import com.baomidou.mybatisplus.annotation.TableName;
-import lombok.Data;
+import org.junit.jupiter.api.Test;
import java.time.LocalDateTime;
-@Data
-@TableName("rmq_settings")
-public class RmqSettings {
+import static org.assertj.core.api.Assertions.assertThat;
- @TableId(type = IdType.ASSIGN_UUID)
- private String id;
+class RmqSettingsTest {
- private String json;
+ @Test
+ void toStringShouldNotExposePersistedSettingsJson() {
+ RmqSettings settings = new RmqSettings();
+ settings.setId("settings");
+ settings.setJson("{\"apiKey\":\"sk-secret\",\"model\":\"gpt-4o\"}");
+ settings.setUpdatedAt(LocalDateTime.of(2026, 8, 3, 12, 0));
- private LocalDateTime updatedAt;
+ String text = settings.toString();
+
+ assertThat(text).contains("id=settings");
+ assertThat(text).contains("updatedAt=2026-08-03T12:00");
+ assertThat(text).doesNotContain("json");
+ assertThat(text).doesNotContain("sk-secret");
+ }
}
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/settings/DataSourceTestDTO.java
b/server/src/test/java/org/apache/rocketmq/studio/settings/DataSourceTestDTOTest.java
similarity index 51%
copy from
server/src/main/java/org/apache/rocketmq/studio/settings/DataSourceTestDTO.java
copy to
server/src/test/java/org/apache/rocketmq/studio/settings/DataSourceTestDTOTest.java
index ecfba0ec..c6e0970a 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/settings/DataSourceTestDTO.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/settings/DataSourceTestDTOTest.java
@@ -16,23 +16,28 @@
*/
package org.apache.rocketmq.studio.settings;
-import jakarta.validation.constraints.NotBlank;
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
+import org.junit.jupiter.api.Test;
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class DataSourceTestDTO {
- @NotBlank(message = "url is required")
- private String url;
- @NotBlank(message = "type is required")
- private String type;
- private String auth;
- private String username;
- private String password;
- private String bearerToken;
+import static org.assertj.core.api.Assertions.assertThat;
+
+class DataSourceTestDTOTest {
+
+ @Test
+ void toStringShouldNotExposeCredentials() {
+ DataSourceTestDTO request = DataSourceTestDTO.builder()
+ .url("http://prometheus:9090";)
+ .type("prometheus")
+ .auth("bearer token")
+ .username("prometheus-user")
+ .password("plain-password")
+ .bearerToken("plain-token")
+ .build();
+
+ String value = request.toString();
+
+ assertThat(value).contains("url=http://prometheus:9090";);
+ assertThat(value).contains("username=prometheus-user");
+ assertThat(value).doesNotContain("plain-password");
+ assertThat(value).doesNotContain("plain-token");
+ }
}
