davsclaus commented on code in PR #29705:
URL: https://github.com/apache/camel/pull/29705#discussion_r4551682082
##########
components/camel-zendesk/src/main/java/org/apache/camel/component/zendesk/ZendeskConfiguration.java:
##########
@@ -147,7 +147,15 @@ public boolean equals(Object other) {
public String toString() {
return String.format(
"ZendeskConfiguration:[methodName=%s, serverUrl=%s,
username=%s, password=%s, token=%s, oauthToken=%s]",
- methodName, serverUrl, username, password, token, oauthToken);
+ methodName, serverUrl, username, mask(password), mask(token),
mask(oauthToken));
+ }
+
+ /**
+ * Masks a credential so that logging or a JMX attribute of this
configuration cannot leak it. {@code xxxxxx} is the
+ * mask Camel uses when it sanitizes a URI, and whether the value was set
at all is still visible.
Review Comment:
The equals/hashCode contract still holds here: `equals()` compares exactly
the six fields that `toString()` prints, so two configurations that are equal
print the same string and get the same hash. Configurations that differ only in
a credential can now share a hash code, which the contract allows (unequal
objects may collide); it only costs a collision in a hash-based collection,
which is not a realistic concern for a component configuration. No change
needed, resolving.
_Claude Code on behalf of davsclaus_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
