LuciferYang opened a new pull request, #13221: URL: https://github.com/apache/gravitino/pull/13221
### What changes were proposed in this pull request? `@ToString.Exclude` is added to the credential fields on `OAuth2TokenResponse` (`accessToken`/`refreshToken`) and `SecretsResponse` (the secrets map). Jackson serialization, `equals`/`hashCode`, and `validate()` are unchanged. ### Why are the changes needed? Lombok `@ToString` rendered the bearer credentials and the secrets map in plaintext, so any log statement printing these response objects leaked secret material. Fix: #13218 ### Does this PR introduce _any_ user-facing change? Yes, in log output: `toString()` on `OAuth2TokenResponse` and `SecretsResponse` no longer includes the credential values, so log statements that print these objects no longer leak them. Jackson serialization, `equals`/`hashCode`, and `validate()` are unchanged. ### How was this patch tested? Added `TestSecretBearingResponsesToString`, which pins that `toString()` on both responses does not contain the credential values; it fails on the pre-fix tree (plaintext visible) and passes after the fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
