Aias00 commented on PR #6388: URL: https://github.com/apache/shenyu/pull/6388#issuecomment-4717495505
## Addressed Copilot Review Comments ### Comment #1 — appSecret still in URL query string ✅ Fixed Changed `/appAuth/updateSk` to accept a new `UpdateSkDTO` as `@RequestBody` instead of `@RequestParam`. Both `appKey` and `appSecret` are now sent in the JSON request body, preventing leakage via URLs, browser history, and server access logs. ### Comment #2 — LICENSE file re2j license ✅ Reverted The LICENSE file changes were unrelated to this security fix and accidentally included from a dirty worktree. They have been reverted from this PR. ### Comment #3 — system:authen:list is semantically mismatched ✅ Fixed Changed the `/sandbox/proxyGateway` permission from `system:authen:list` to `system:authen:modify`. The proxy gateway is a write/signing operation, not a read/list operation, so `modify` is the semantically correct existing permission. Adding a brand-new `system:sandbox:proxy` permission would require a database migration across 5 database flavors, which is out of scope for this security fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
