RockteMQ-AI commented on issue #10901:
URL: https://github.com/apache/rocketmq/issues/10901#issuecomment-5267874678
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The reported issue has been verified against the current codebase.
**Root Cause (two issues in `ProxyMetricsManager.java`):**
1. **Incorrect parsing** (lines 151, 191): `item.split(":")` with a strict
`split.length != 2` check rejects valid values containing colons. For example,
`Authorization:Bearer token:xxx` splits into 3 parts and is silently dropped.
Fix: use `split(":", 2)` to split on the first colon only.
2. **Secret exposure in logs** (lines 153, 193): When parsing fails, the
full `labels`/`headers` string is logged at WARN level. If the string contains
`Authorization: Bearer xxx` or `proxy-auth-credential: xxx`, the secret is
written to the log file. Fix: only log the key names or a redacted summary,
never the raw value.
**Impact:** OTLP metrics export configuration. Affects users who configure
custom labels or gRPC exporter headers with colon-containing values.
**Severity:** Medium-High — the secret exposure in logs is a security
concern.
An automated fix proposal can be generated. Reply `/approve` to proceed with
PR generation.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
