Aias00 opened a new issue, #819: URL: https://github.com/apache/rocketmq-dashboard/issues/819
### Bug Description `server/src/main/java/org/apache/rocketmq/studio/model/User.java` includes the raw `password` field in `toString()`. If a `User` instance is logged directly or appears in an exception/debug path, the plaintext password can be written to application logs. ### Expected Behavior `toString()` should not include the raw password. It should either omit the field or render a masked value. ### Actual Behavior The raw password value is concatenated into the string representation. ### Minimal Fix Direction Redact the password in `User.toString()` and add a regression test that verifies the raw password is not present. ### Scope This is a small security hardening item related to Studio login/permission handling. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
