[I] [Bug] Avoid exposing RemoteChannel extendAttribute in toString [rocketmq]

["Aias00 (via GitHub)" <gi...@apache.org>]

Aias00 opened a new issue, #10762:
URL: https://github.com/apache/rocketmq/issues/10762

   ### Problem
   
   `RemoteChannel.toString()` currently includes the complete `extendAttribute` value. For gRPC clients this attribute may contain serialized channel settings or other runtime metadata. If a `RemoteChannel` is included in logs or diagnostics, the full attribute can be exposed unintentionally.
   
   ### Evidence
   
   `proxy/src/main/java/org/apache/rocketmq/proxy/processor/channel/RemoteChannel.java` currently renders:
   
   `extendAttribute` directly in `toString()`.
   
   ### Expected behavior
   
   `RemoteChannel.toString()` should keep useful diagnostics such as channel id, protocol type, and remote proxy IP, but should not include the raw `extendAttribute` content. A presence flag and length are sufficient for debugging most cases.
   
   ### Scope
   
   This is in the Proxy / Studio track scope for safer client/runtime diagnostics. The proposed fix is a small logging/stringification hardening change and does not change channel serialization, decoding, or runtime behavior.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Avoid exposing RemoteChannel extendAttribute in toString [rocketmq]

["RockteMQ-AI (via GitHub)" <gi...@apache.org>]

RockteMQ-AI commented on issue #10762:
URL: https://github.com/apache/rocketmq/issues/10762#issuecomment-5162895978

   **Issue Evaluation**
   
   Category: `type/bug` | Status: **Confirmed**
   
   The reported issue has been verified against the current codebase.
   
   **Root Cause:** `RemoteChannel.toString()` at line 113 includes `.add("extendAttribute", extendAttribute)`, which dumps the full extend attribute content. For gRPC clients this may contain serialized channel settings or runtime metadata.
   
   **Impact:** If a `RemoteChannel` appears in logs or diagnostics, the full `extendAttribute` content is exposed unintentionally.
   
   **Severity:** low
   
   **Suggested fix:** Replace the raw `extendAttribute` value in `toString()` with a presence flag and length (e.g. `extendAttribute=present(length=123)` or `extendAttribute=empty`), keeping useful diagnostics without exposing the full content.
   
   An automated fix proposal will be generated. Reply `/approve` to proceed with PR generation.
   
   ---
   *Automated evaluation by github-manager-bot*


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org