RockteMQ-AI commented on issue #10950: URL: https://github.com/apache/rocketmq/issues/10950#issuecomment-5311669247
**Issue Evaluation** Category: `type/bug` | Status: **Confirmed** | Severity: **High** The reported issue has been verified against the current codebase (`develop` @ `293f588571`). **Root Cause:** No centralized sensitivity-aware logging mechanism exists. Configuration objects are serialized through two generic paths that log values without masking: - `MixAll.printObjectProperties` (`MixAll.java:335`) — direct `logger.info(name + "=" + value)` with no redaction - `Configuration.merge/mergeIfExist` (`Configuration.java:325,339`) — logs raw old/new values - Proxy startup (`ProxyStartup.java:127`) — serializes full `ProxyConfig` via `JSON.toJSONString` with no field filtering - Metrics exporter header validation (`ProxyMetricsManager.java:193`, `BrokerMetricsManager.java:405`, `ControllerMetricsManager.java:343`) — logs invalid headers verbatim **Impact:** Sensitive fields (`tlsKeyPassword`, `metricsGrpcExporterHeader`, `innerClientAuthenticationCredentials`, proxy credentials) are written to log files in plaintext. Log files typically have weaker access controls than config files and are ingested by aggregation systems, broadening the exposure surface. **Affected Components:** Proxy, Broker, Controller, BrokerContainer — all configuration logging paths. The proposed `@SensitiveConfig` marker approach is a sound direction. An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation. --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
