This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 57818da6 fix(security): exclude credentials from request DTO toString
(#1711)
57818da6 is described below
commit 57818da6b53667af97064453fb728eb7a9600333
Author: youngkermit8-coder <[email protected]>
AuthorDate: Tue Aug 11 20:52:09 2026 +0800
fix(security): exclude credentials from request DTO toString (#1711)
Signed-off-by: youngkermit8-coder <[email protected]>
---
.../instance/acl/UpsertPlainAccessConfigDTO.java | 3 +
.../request/MetricsDataSourceQueryRequest.java | 3 +
.../rocketmq/studio/ops/ai/LlmConfigDTO.java | 2 +
.../credential/CreateCloudCredentialDTO.java | 3 +
.../credential/UpdateCloudCredentialDTO.java | 2 +
.../studio/auth/SensitiveRequestToStringTest.java | 69 ++++++++++++++++++++++
6 files changed, 82 insertions(+)
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/UpsertPlainAccessConfigDTO.java
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/UpsertPlainAccessConfigDTO.java
index 67675645..4eb259c9 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/UpsertPlainAccessConfigDTO.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/UpsertPlainAccessConfigDTO.java
@@ -18,6 +18,7 @@ package org.apache.rocketmq.studio.instance.acl;
import jakarta.validation.constraints.NotBlank;
import lombok.Data;
+import lombok.ToString;
import java.util.List;
@@ -30,8 +31,10 @@ import java.util.List;
public class UpsertPlainAccessConfigDTO {
@NotBlank(message = "accessKey is required")
+ @ToString.Exclude
private String accessKey;
+ @ToString.Exclude
private String secretKey;
private String whiteRemoteAddress;
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/model/request/MetricsDataSourceQueryRequest.java
b/server/src/main/java/org/apache/rocketmq/studio/model/request/MetricsDataSourceQueryRequest.java
index 61411ce6..42afb2ef 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/model/request/MetricsDataSourceQueryRequest.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/model/request/MetricsDataSourceQueryRequest.java
@@ -20,6 +20,7 @@ import jakarta.validation.Valid;
import jakarta.validation.constraints.NotNull;
import org.apache.rocketmq.studio.cluster.metrics.MetricQueryDTO;
import lombok.Data;
+import lombok.ToString;
/**
* Request to run a PromQL range query against a configured data source.
@@ -40,7 +41,9 @@ public class MetricsDataSourceQueryRequest {
private String username;
+ @ToString.Exclude
private String password;
+ @ToString.Exclude
private String bearerToken;
}
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/ops/ai/LlmConfigDTO.java
b/server/src/main/java/org/apache/rocketmq/studio/ops/ai/LlmConfigDTO.java
index d2220e6e..93831343 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/ops/ai/LlmConfigDTO.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/ops/ai/LlmConfigDTO.java
@@ -17,12 +17,14 @@
package org.apache.rocketmq.studio.ops.ai;
import lombok.Data;
+import lombok.ToString;
@Data
public class LlmConfigDTO {
private String provider;
private String engine;
+ @ToString.Exclude
private String apiKey;
private String apiBase;
private String model;
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/provider/credential/CreateCloudCredentialDTO.java
b/server/src/main/java/org/apache/rocketmq/studio/provider/credential/CreateCloudCredentialDTO.java
index 077349e8..57425d99 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/provider/credential/CreateCloudCredentialDTO.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/provider/credential/CreateCloudCredentialDTO.java
@@ -19,6 +19,7 @@ package org.apache.rocketmq.studio.provider.credential;
import jakarta.validation.constraints.NotBlank;
import org.apache.rocketmq.studio.common.domain.enums.InstanceVendor;
import lombok.Data;
+import lombok.ToString;
import java.util.Locale;
@@ -32,9 +33,11 @@ public class CreateCloudCredentialDTO {
private String vendor;
@NotBlank(message = "credential accessKey is required")
+ @ToString.Exclude
private String accessKey;
@NotBlank(message = "credential secretKey is required")
+ @ToString.Exclude
private String secretKey;
private String remark;
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/provider/credential/UpdateCloudCredentialDTO.java
b/server/src/main/java/org/apache/rocketmq/studio/provider/credential/UpdateCloudCredentialDTO.java
index 6219c5bc..9b22bd1a 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/provider/credential/UpdateCloudCredentialDTO.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/provider/credential/UpdateCloudCredentialDTO.java
@@ -18,6 +18,7 @@ package org.apache.rocketmq.studio.provider.credential;
import jakarta.validation.constraints.NotBlank;
import lombok.Data;
+import lombok.ToString;
@Data
public class UpdateCloudCredentialDTO {
@@ -27,6 +28,7 @@ public class UpdateCloudCredentialDTO {
private String name;
+ @ToString.Exclude
private String secretKey;
private String remark;
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/auth/SensitiveRequestToStringTest.java
b/server/src/test/java/org/apache/rocketmq/studio/auth/SensitiveRequestToStringTest.java
new file mode 100644
index 00000000..a7ef476e
--- /dev/null
+++
b/server/src/test/java/org/apache/rocketmq/studio/auth/SensitiveRequestToStringTest.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.studio.auth;
+
+import org.apache.rocketmq.studio.instance.acl.UpsertPlainAccessConfigDTO;
+import org.apache.rocketmq.studio.model.request.MetricsDataSourceQueryRequest;
+import org.apache.rocketmq.studio.ops.ai.LlmConfigDTO;
+import org.apache.rocketmq.studio.provider.credential.CreateCloudCredentialDTO;
+import org.apache.rocketmq.studio.provider.credential.UpdateCloudCredentialDTO;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class SensitiveRequestToStringTest {
+
+ @Test
+ void requestToStringShouldNotExposeSecrets() {
+ LlmConfigDTO llm = new LlmConfigDTO();
+ llm.setProvider("openai");
+ llm.setApiKey("llm-secret-value");
+
+ CreateCloudCredentialDTO createCredential = new
CreateCloudCredentialDTO();
+ createCredential.setName("production");
+ createCredential.setAccessKey("cloud-access-key");
+ createCredential.setSecretKey("cloud-secret-key");
+
+ UpdateCloudCredentialDTO updateCredential = new
UpdateCloudCredentialDTO();
+ updateCredential.setId("credential-1");
+ updateCredential.setSecretKey("rotated-cloud-secret");
+
+ UpsertPlainAccessConfigDTO plainAccess = new
UpsertPlainAccessConfigDTO();
+ plainAccess.setAccessKey("rocketmq-access-key");
+ plainAccess.setSecretKey("rocketmq-secret-key");
+
+ MetricsDataSourceQueryRequest metrics = new
MetricsDataSourceQueryRequest();
+ metrics.setInstanceId("instance-1");
+ metrics.setPassword("metrics-password");
+ metrics.setBearerToken("metrics-bearer-token");
+
+ assertThat(llm.toString())
+ .contains("provider=openai")
+ .doesNotContain("llm-secret-value");
+ assertThat(createCredential.toString())
+ .contains("name=production")
+ .doesNotContain("cloud-access-key", "cloud-secret-key");
+ assertThat(updateCredential.toString())
+ .contains("id=credential-1")
+ .doesNotContain("rotated-cloud-secret");
+ assertThat(plainAccess.toString())
+ .doesNotContain("rocketmq-access-key", "rocketmq-secret-key");
+ assertThat(metrics.toString())
+ .contains("instanceId=instance-1")
+ .doesNotContain("metrics-password", "metrics-bearer-token");
+ }
+}
