RockteMQ-AI commented on issue #1710: URL: https://github.com/apache/rocketmq-dashboard/issues/1710#issuecomment-5251748267
**Issue Evaluation** Category: `type/bug` (security) | Severity: **Medium** | Status: **Confirmed** Credential fields in multiple request DTOs are exposed in `toString()` output, which Spring MVC logs at DEBUG level via `org.springframework.web`. This means plaintext secrets (`apiKey`, `accessKey`, `secretKey`, `password`, `bearerToken`) can appear in development logs. **Root Cause:** Lombok `@Data` generates `toString()` that includes all fields. Several credential-bearing DTOs (`LlmConfigDTO`, `CreateCloudCredentialDTO`, `UpdateCloudCredentialDTO`, `UpsertPlainAccessConfigDTO`, `MetricsDataSourceQueryRequest`) lack `@ToString.Exclude` on their secret fields, while similar DTOs (`LoginDTO`, `GeneralSettingsUpdateDTO`, `DataSourceTestDTO`) already apply this exclusion correctly. **Impact:** Plaintext credentials in log files — risk of credential leakage through log aggregation, debugging output, or log file access. **Proposed Fix Assessment:** Adding `@ToString.Exclude` to the listed credential fields is the correct and idiomatic fix. The regression test approach (verifying non-secret context is retained while secret values are excluded) is sound. This is a valid security issue. A fix PR is welcome. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
