You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "Aias00 (via GitHub)" <gi...@apache.org> on 2026/08/03 08:39:14 UTC
[I] [Bug] ACL user VO exposes credentials in toString [rocketmq-dashboard]
Aias00 opened a new issue, #827:
URL: https://github.com/apache/rocketmq-dashboard/issues/827
## Problem
`AclUserVO` uses Lombok `@Data` and carries generated ACL credentials (`accessKey` and `secretKey`). Lombok includes all fields in the generated `toString()` output by default, so accidental VO logging or debug output can expose ACL credentials.
## Evidence
- `server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java` declares `@Data`.
- The VO contains `accessKey` and `secretKey` fields.
- `AclService#createUser` generates and stores real values for both fields before returning the saved VO.
## Expected behavior
Credential fields should be excluded from generated diagnostic output while non-sensitive ACL user metadata remains visible.
## Scope
Small hardening fix for the Studio ACL user management path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] ACL user VO exposes credentials in toString [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins closed issue #827: [Bug] ACL user VO exposes credentials in toString
URL: https://github.com/apache/rocketmq-dashboard/issues/827
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] ACL user VO exposes credentials in toString [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins commented on issue #827:
URL: https://github.com/apache/rocketmq-dashboard/issues/827#issuecomment-5177565581
Resolved by #928 (merged into rocketmq-studio as 056a82b).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org