gnodet commented on code in PR #25093:
URL: https://github.com/apache/camel/pull/25093#discussion_r3645907647
##########
dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/McpSecurityInterceptor.java:
##########
@@ -84,11 +86,17 @@ Object intercept(InvocationContext ctx) throws Exception {
try {
Object result = ctx.proceed();
- // Secret redaction on string results
- if (config.isRedactionEnabled() && result instanceof String s) {
- if (redactor.containsSecret(s)) {
- result = redactor.redact(s);
- wasRedacted = true;
+ // Secret redaction. Free-text (String) results go through the
regex redactor; structured results
+ // (Map/List, such as the JsonObject returned by the runtime
tools) are scrubbed by key name in place,
+ // which is what catches JSON-quoted values the value regex cannot
match.
+ if (config.isRedactionEnabled() && result != null) {
+ if (result instanceof String s) {
+ if (redactor.containsSecret(s)) {
+ result = redactor.redact(s);
+ wasRedacted = true;
Review Comment:
**Low:** `containsSecret(s)` internally calls `redact(s)` and compares the
result. If it returns true, `redact(s)` is called again here — running the full
masking pipeline (DefaultMaskingFormatter + custom patterns) twice. Could be
simplified:
```suggestion
String redacted = redactor.redact(s);
if (!redacted.equals(s)) {
result = redacted;
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
