This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 59aaadfd7 fix(k8s): redact certificate private keys (#4555)
59aaadfd7 is described below
commit 59aaadfd7434e451b45b1ac8694fe6437ad48e9a
Author: youngkermit8-coder <[email protected]>
AuthorDate: Mon Sep 21 21:02:15 2026 +0800
fix(k8s): redact certificate private keys (#4555)
`CreateCertDTO`, `K8sCertVO` and `RmqK8sCertificate` are all Lombok
`@Data`, so their generated `toString()` printed `keyPem` in full. `K8sCertVO`
carries `@JsonProperty(access = WRITE_ONLY)`, which keeps the private key out
of API responses but says nothing about `toString()`; the other two have no
protection at all. The three sit on the live path — `K8sCertService` builds the
DTO from `command.getKeyPem()` and the VO from `cert.getKeyPem()`, and
`MybatisPlusK8sCertRepository` copies [...]
All three fields now carry `@ToString.Exclude`, matching how the cloud
credential, ACL user and login types in this repo already handle theirs, and
`K8sCertificateSecretRedactionTest` asserts each representation keeps `k8sId`
while omitting the key. Persistence, JSON shape and certificate parsing are
untouched.
Other `@Data` classes still print credentials in `toString` —
`RmqCloudCredential`, `RmqAclUser`, `PlainAccessConfigVO`,
`MetricsDataSourceConfig` and `Acl2PolicyContext` — and are left for a
follow-up.
---
.../rocketmq/studio/cluster/k8s/CreateCertDTO.java | 2 +
.../rocketmq/studio/cluster/k8s/K8sCertVO.java | 2 +
.../persistence/entity/RmqK8sCertificate.java | 2 +
.../k8s/K8sCertificateSecretRedactionTest.java | 62 ++++++++++++++++++++++
4 files changed, 68 insertions(+)
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/cluster/k8s/CreateCertDTO.java
b/server/src/main/java/org/apache/rocketmq/studio/cluster/k8s/CreateCertDTO.java
index 702ea3894..69950998e 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/cluster/k8s/CreateCertDTO.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/cluster/k8s/CreateCertDTO.java
@@ -22,6 +22,7 @@ import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;
+import lombok.ToString;
import java.util.List;
@@ -40,5 +41,6 @@ public class CreateCertDTO {
private String issuer;
private List<String> san;
private String certPem;
+ @ToString.Exclude
private String keyPem;
}
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/cluster/k8s/K8sCertVO.java
b/server/src/main/java/org/apache/rocketmq/studio/cluster/k8s/K8sCertVO.java
index 384829519..da3b3ec8f 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/cluster/k8s/K8sCertVO.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/cluster/k8s/K8sCertVO.java
@@ -25,6 +25,7 @@ import lombok.Builder;
import lombok.Data;
import lombok.EqualsAndHashCode;
import lombok.NoArgsConstructor;
+import lombok.ToString;
import java.time.LocalDateTime;
import java.util.List;
@@ -47,5 +48,6 @@ public class K8sCertVO extends BaseEntity {
private String certPem;
// The private key is persisted but never serialized into API responses.
@JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
+ @ToString.Exclude
private String keyPem;
}
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqK8sCertificate.java
b/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqK8sCertificate.java
index e83d1a600..a66abec86 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqK8sCertificate.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/persistence/entity/RmqK8sCertificate.java
@@ -20,6 +20,7 @@ import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableId;
import com.baomidou.mybatisplus.annotation.TableName;
import lombok.Data;
+import lombok.ToString;
import java.time.LocalDateTime;
@@ -50,6 +51,7 @@ public class RmqK8sCertificate {
private String certPem;
+ @ToString.Exclude
private String keyPem;
private LocalDateTime gmtCreate;
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/cluster/k8s/K8sCertificateSecretRedactionTest.java
b/server/src/test/java/org/apache/rocketmq/studio/cluster/k8s/K8sCertificateSecretRedactionTest.java
new file mode 100644
index 000000000..cc61d5bdc
--- /dev/null
+++
b/server/src/test/java/org/apache/rocketmq/studio/cluster/k8s/K8sCertificateSecretRedactionTest.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.studio.cluster.k8s;
+
+import org.apache.rocketmq.studio.persistence.entity.RmqK8sCertificate;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class K8sCertificateSecretRedactionTest {
+
+ private static final String PRIVATE_KEY = "sensitive-private-key-material";
+
+ @Test
+ void createRequestToStringShouldExcludePrivateKeyTest() {
+ CreateCertDTO request = CreateCertDTO.builder()
+ .k8sId("production-k8s")
+ .keyPem(PRIVATE_KEY)
+ .build();
+
+ assertThat(request.toString())
+ .contains("production-k8s")
+ .doesNotContain(PRIVATE_KEY);
+ }
+
+ @Test
+ void responseValueToStringShouldExcludePrivateKeyTest() {
+ K8sCertVO certificate = K8sCertVO.builder()
+ .k8sId("production-k8s")
+ .keyPem(PRIVATE_KEY)
+ .build();
+
+ assertThat(certificate.toString())
+ .contains("production-k8s")
+ .doesNotContain(PRIVATE_KEY);
+ }
+
+ @Test
+ void persistenceEntityToStringShouldExcludePrivateKeyTest() {
+ RmqK8sCertificate entity = new RmqK8sCertificate();
+ entity.setK8sId("production-k8s");
+ entity.setKeyPem(PRIVATE_KEY);
+
+ assertThat(entity.toString())
+ .contains("production-k8s")
+ .doesNotContain(PRIVATE_KEY);
+ }
+}
