Frun1na opened a new issue, #6122: URL: https://github.com/apache/rocketmq-dashboard/issues/6122
### Before Creating the Bug Report - [x] I have searched the [open issues](https://github.com/apache/rocketmq-dashboard/issues) of this repository and believe that this is not a duplicate. - [x] This is a defect in RocketMQ Studio, not a usage question and not a defect in another Apache RocketMQ repository. - [x] I can reproduce this on the current `rocketmq-studio` branch, or I have stated the exact version I am running below. ### Studio Version branch: `rocketmq-studio` git commit id: `5e4c39b0` deployed as: reproduced by unit tests against that commit (the affected code is the backend model layer) ### Runtime Environment OS: Ubuntu on WSL2 MySQL: not applicable — the defect is the generated `toString()` of two model classes, reproduced in a JUnit 5 test browser: not applicable ### Connected RocketMQ Cluster RocketMQ version: not applicable — no cluster participates; the values come from Studio's own configuration models access mode: not applicable deployment: not applicable ### Describe the Bug A Lombok `@Data` class generates a `toString()` that prints every field, so a single log line, exception message or diagnostic dump that renders one of these objects writes the credential to disk in clear text: - `model/MetricsDataSourceConfig.java` — `password` and `bearerToken`. The class's own javadoc says "Sensitive fields such as password / bearerToken should be encrypted at rest in production", and its request counterpart `MetricsDataSourceQueryRequest` already excludes exactly those two fields. - `model/Acl2PolicyContext.java` — `accessKey` and `secretKey`, the same pair the plain-access write DTO (`UpsertPlainAccessConfigDTO`) already excludes. The repository has already accepted this fix twice for the same reason — #4555 (certificate private keys) and #4472 (`LlmProperties` provider token) — and #4555's description names the remaining credential-bearing types (this pair, plus the persistence/ACL ones covered by #6094) as its follow-up. ### Steps to Reproduce 1. Build any of the two objects with a secret and render it, e.g. `log.info("metrics data source {}", config)` or an assertion failure that prints the object. 2. Or run the regression test: ``` cd server && mvn -B -ntp test -Dtest=CredentialModelToStringRedactionTest Expecting actual: "MetricsDataSourceConfig(name=prometheus-prod, url=http://prometheus:9090, authType=null, username=null, password=sensitive-secret-material, bearerToken=sensitive-secret-material, ...)" not to contain: "sensitive-secret-material" ``` ### What Did You Expect to See? The representation names the object's identity (`name`, `url`, `policyName`) and omits the credentials, the way `MetricsDataSourceQueryRequest`, `UpsertPlainAccessConfigDTO`, `RmqSettings`, `RmqStudioUser`, `RmqK8sCertificate`, `K8sCertVO`, `LoginDTO` and `ResetPasswordDTO` already behave. ### What Did You See Instead? `MetricsDataSourceConfig` prints the data source password and bearer token and `Acl2PolicyContext` prints the ACL access key and secret key in full. ### Additional Context A fix with regression tests follows in a pull request. ### Are You Willing to Submit a Pull Request? - [x] Yes, I am willing to submit a pull request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
