youngkermit8-coder opened a new pull request, #1711: URL: https://github.com/apache/rocketmq-dashboard/pull/1711
## Summary - exclude LLM, cloud, plain-access, and metrics credentials from Lombok-generated request strings - keep useful non-secret request context in debug output - add a regression test covering every affected HTTP request DTO ## Root cause The development profile enables Spring Web DEBUG logging. Spring MVC logs deserialized `@RequestBody` objects using their generated `toString()` methods, but five credential-bearing request DTOs used Lombok `@Data` without excluding their secret fields. Valid requests could therefore place plaintext API keys, access/secret keys, passwords, and bearer tokens in development logs. ## Impact Credential fields remain available to JSON deserialization and all existing business logic, but are no longer rendered by Lombok `toString()` or Spring's request-body debug logging path. Closes #1710 ## Validation - regression first failed on the exact upstream branch with `apiKey=llm-secret-value` in the generated string - `mvn -Dtest=SensitiveRequestToStringTest,LlmControllerTest,CreateCloudCredentialDTOTest,MetricsControllerTest,AclControllerTest test` — 34 tests passed - combined with the independent CRLF test fix in #1705, `mvn test` — 959 tests passed - `mvn -DskipTests package` — passed - Checkstyle — 0 violations -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
