RockteMQ-AI commented on issue #10901:
URL: https://github.com/apache/rocketmq/issues/10901#issuecomment-5248857037
**Issue Evaluation**
Category: `type/bug` | Module: `module/proxy` | Status: **Confirmed**
The reported issue has been verified against the current codebase (`develop`
branch).
**Root Cause:** `ProxyMetricsManager#start` (lines 151, 191) uses
`item.split(":")` to parse key-value pairs for both `metricsLabel` and
`metricsGrpcExporterHeader`. When a header value contains colons (e.g.,
`Authorization:Bearer token:xxx`), the split produces more than 2 segments and
the entry is silently discarded.
**Security Concern:** When parsing fails, `log.warn()` at lines 153 and 193
logs the complete configuration string, which may contain authorization tokens,
API keys, or other credentials embedded in header values.
**Impact:** Valid OTLP headers with colons in values are rejected, and
credential leakage via log output is possible.
**Severity:** High — affects metrics pipeline configuration and may expose
secrets in logs.
An automated fix proposal can be generated. Reply `/approve` to proceed with
PR generation.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
