oscerd commented on code in PR #25093:
URL: https://github.com/apache/camel/pull/25093#discussion_r3656040950
##########
dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/McpSecurityInterceptor.java:
##########
@@ -84,11 +86,17 @@ Object intercept(InvocationContext ctx) throws Exception {
try {
Object result = ctx.proceed();
- // Secret redaction on string results
- if (config.isRedactionEnabled() && result instanceof String s) {
- if (redactor.containsSecret(s)) {
- result = redactor.redact(s);
- wasRedacted = true;
+ // Secret redaction. Free-text (String) results go through the
regex redactor; structured results
+ // (Map/List, such as the JsonObject returned by the runtime
tools) are scrubbed by key name in place,
+ // which is what catches JSON-quoted values the value regex cannot
match.
+ if (config.isRedactionEnabled() && result != null) {
+ if (result instanceof String s) {
+ if (redactor.containsSecret(s)) {
+ result = redactor.redact(s);
+ wasRedacted = true;
Review Comment:
Done in 8e9decd — the String branch now calls redact(s) once and compares
the result to the input to set wasRedacted, so the masking pipeline no longer
runs twice. containsSecret() stays as a tested public API on the
redactor.\n\n_Claude Code on behalf of Andrea Cosentino (@oscerd)._
##########
dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/McpSecurityInterceptor.java:
##########
@@ -84,11 +86,17 @@ Object intercept(InvocationContext ctx) throws Exception {
try {
Object result = ctx.proceed();
- // Secret redaction on string results
- if (config.isRedactionEnabled() && result instanceof String s) {
- if (redactor.containsSecret(s)) {
- result = redactor.redact(s);
- wasRedacted = true;
+ // Secret redaction. Free-text (String) results go through the
regex redactor; structured results
+ // (Map/List, such as the JsonObject returned by the runtime
tools) are scrubbed by key name in place,
+ // which is what catches JSON-quoted values the value regex cannot
match.
+ if (config.isRedactionEnabled() && result != null) {
+ if (result instanceof String s) {
+ if (redactor.containsSecret(s)) {
+ result = redactor.redact(s);
+ wasRedacted = true;
+ }
+ } else if (result instanceof Map<?, ?> || result instanceof
List<?>) {
Review Comment:
Done in 8e9decd — the String branch now calls redact(s) once and compares
the result to the input to set wasRedacted, so the masking pipeline no longer
runs twice. containsSecret() stays as a tested public API on the
redactor.\n\n_Claude Code on behalf of Andrea Cosentino (@oscerd)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
