SEZ9 commented on PR #11613: URL: https://github.com/apache/seatunnel/pull/11613#issuecomment-5691480889
Thanks for pushing `a947704b`. Diffing `1d815881c..HEAD` shows this is a substantive hardening pass (`a947704bf`, "[Fix][Zeta] Harden Web UI operations") rather than just a rebase, and the `dev`-sync merges cleared the earlier conflict. Two changes in the new commit stand out as good fixes for latent issues: - `UpdateTagsService` no longer logs the full tag map; `summarizeTagsForAudit()` logs only a count, and `shouldExcludeTagContentFromAuditSummary` locks that in. Tag values are arbitrary user input, so this closes a real secret-in-logs risk. - `mutualTlsEnabled` in `/http-service/status` is now derived from the effective Jetty `SslContextFactory` (`getNeedClientAuth()`) instead of whether trust-store fields are set, so the status output reflects the enforced state rather than config intent. Separately from those, I'm walking the same diff against my earlier findings and will post a per-finding status shortly: 1. **PR11613-F3 (Security)** — `/update-local-member-tags` and `/http-service/status` sitting behind the same basic-auth/mTLS handler chain as the existing endpoints. 2. **PR11613-F2 (Test)** — RestApiIT/E2E coverage for the two new endpoints and the `/update-tags` flat `Map<String,String>` contract, beyond the unit tests. 3. **PR11613-F4 (Functional)** — behaviour of the UI tag editor behind a load balancer / reverse proxy, or when only the master exposes the Web UI, given local-only UUID validation; if this is a documented limitation, it should be stated explicitly. 4. **PR11613-F6 (Robustness)** — a guard or documented behaviour for "Restore Latest State" when the source job is still RUNNING or its checkpoint state has been cleaned up. 5. **PR11613-F1 / F5 / F7 (Docs)** — a clearly flat example key for `/update-tags`, a dedicated `/update-local-member-tags` section with request/response/error examples, and per-field descriptions plus a consistent example port for `/http-service/status`. 6. **PR11613-F8 (Docs)** — screenshots for the new Action controls, Submit Job panel, Checkpoints tab and Operations page, or dropping the stale ones. If any of these were intentionally left out of scope for this PR, a quick note would help me mark them accordingly. <!-- streview-comment:1080 --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
