messere1 opened a new issue, #10901:
URL: https://github.com/apache/rocketmq/issues/10901

   ### Before Creating the Bug Report
   
   - [x] I found a bug, not just a question.
   - [x] I searched existing issues and pull requests for 
metricsGrpcExporterHeader, OTLP header parsing, and exporter-header secret 
leakage.
   - [x] I confirmed the affected code belongs to this repository.
   
   ### Describe the Bug
   
   ProxyMetricsManager#start parses metricsGrpcExporterHeader entries with 
item.split(:).
   
   This has two related problems:
   
   1. A valid header value containing a colon (for example a URI or a 
structured authorization value) produces more than two segments and is 
discarded.
   2. When parsing fails, the warning logs the complete header configuration. 
That string may contain authorization tokens, API keys, or other credentials.
   
   The same broad split behavior is also used for metricsLabel, where a label 
value containing a colon is unnecessarily rejected.
   
   ### Expected Behavior
   
   - Split each entry at the first colon only.
   - Trim and require a non-empty key.
   - Preserve the remainder of the value, including additional colons.
   - Warn about an invalid entry without logging the complete configured labels 
or headers.
   - Add focused unit tests for colon-containing values, empty keys, malformed 
entries, and secret-safe diagnostics.
   
   ### Affected Area
   
   RocketMQ Proxy metrics initialization / OTLP exporter configuration. This is 
relevant to RocketMQ Studio deployments that use Proxy metrics for 
observability.
   
   ### Proposed Scope
   
   Keep the change local to metrics key/value parsing and its tests. Do not 
change exporter defaults, protocols, or public APIs.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to