Aias00 commented on issue #2336: URL: https://github.com/apache/rocketmq-dashboard/issues/2336#issuecomment-5323916053
Thanks for the review. This report targets the `rocketmq-studio` branch, not the repository default branch. The affected settings feature is present on that branch: - `server/src/main/java/org/apache/rocketmq/studio/settings/SettingsController.java` exposes `GET /api/settings/general`. - The endpoint returns `GeneralSettingsVO`. Before the fix, its `dingtalkWebhook` and `smsWebhook` fields were serializable raw values, while the authorization interceptor permits authenticated reader users to access ordinary GET endpoints. A DingTalk webhook URL commonly contains its bearer token in the query string. PR #2341 fixes the disclosure on `rocketmq-studio`: raw webhook values are write-only, while the read response exposes only `dingtalkWebhookConfigured` and `smsWebhookConfigured` state. It also adds regression tests that assert a reader response omits the raw URLs. The PR is ready, mergeable, and all CI checks are passing. Please evaluate the report and PR against `rocketmq-studio`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
