[PR] [ISSUE #1710] Redact credentials from request logs [rocketmq-dashboard]

["youngkermit8-coder (via GitHub)" <gi...@apache.org>]

youngkermit8-coder opened a new pull request, #1711:
URL: https://github.com/apache/rocketmq-dashboard/pull/1711

   ## Summary
   
   - exclude LLM, cloud, plain-access, and metrics credentials from Lombok-generated request strings
   - keep useful non-secret request context in debug output
   - add a regression test covering every affected HTTP request DTO
   
   ## Root cause
   
   The development profile enables Spring Web DEBUG logging. Spring MVC logs deserialized `@RequestBody` objects using their generated `toString()` methods, but five credential-bearing request DTOs used Lombok `@Data` without excluding their secret fields. Valid requests could therefore place plaintext API keys, access/secret keys, passwords, and bearer tokens in development logs.
   
   ## Impact
   
   Credential fields remain available to JSON deserialization and all existing business logic, but are no longer rendered by Lombok `toString()` or Spring's request-body debug logging path.
   
   Closes #1710
   
   ## Validation
   
   - regression first failed on the exact upstream branch with `apiKey=llm-secret-value` in the generated string
   - `mvn -Dtest=SensitiveRequestToStringTest,LlmControllerTest,CreateCloudCredentialDTOTest,MetricsControllerTest,AclControllerTest test` — 34 tests passed
   - combined with the independent CRLF test fix in #1705, `mvn test` — 959 tests passed
   - `mvn -DskipTests package` — passed
   - Checkstyle — 0 violations
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [ISSUE #1710] Redact credentials from request logs [rocketmq-dashboard]

["lizhimins (via GitHub)" <gi...@apache.org>]

lizhimins merged PR #1711:
URL: https://github.com/apache/rocketmq-dashboard/pull/1711


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org