youngkermit8-coder opened a new issue, #1710: URL: https://github.com/apache/rocketmq-dashboard/issues/1710
## What happened The development profile enables DEBUG logging for `org.springframework.web`. Spring MVC logs successfully deserialized `@RequestBody` objects at that level by calling their `toString()` methods. Several credential-bearing request DTOs use Lombok `@Data` without excluding their secret fields: - `LlmConfigDTO.apiKey` - `CreateCloudCredentialDTO.accessKey` and `secretKey` - `UpdateCloudCredentialDTO.secretKey` - `UpsertPlainAccessConfigDTO.accessKey` and `secretKey` - `MetricsDataSourceQueryRequest.password` and `bearerToken` As a result, valid requests to the corresponding LLM, cloud credential, plain-access, and metrics endpoints can place plaintext credentials in development logs. Similar request types such as `LoginDTO`, `GeneralSettingsUpdateDTO`, and `DataSourceTestDTO` already use `@ToString.Exclude` for this reason. ## Reproduction Construct an `LlmConfigDTO` with an API key and inspect its generated string representation: ```text LlmConfigDTO(provider=openai, ..., apiKey=llm-secret-value, ...) ``` The same behavior occurs for the other request types above. Controller tests running with the development profile also show Spring's `Read "application/json" to [...]` debug logging path. ## Expected behavior Credential fields must remain available to JSON deserialization and application logic, but must not appear in generated `toString()` output or Spring Web DEBUG logs. ## Proposed fix Apply Lombok `@ToString.Exclude` to the credential fields and add a regression test that verifies every affected request retains useful non-secret context without containing any supplied secret value. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
