RockteMQ-AI commented on issue #10950:
URL: https://github.com/apache/rocketmq/issues/10950#issuecomment-5370215828
Hi @qianye1001, thanks for reporting this!
I've analyzed this issue against the codebase and can confirm this appears
to be a **real bug**.
**Root Cause:** ** Configuration logging code at multiple sites prints field
values verbatim with no masking or sensitivity filtering. Specifically: (1)
`MixAll.printObjectProperties()` (MixAll.java:309-340) uses reflection to log
every non-static field as `name=value` with no masking; (2)
`ConfigurationManager.formatProxyConfig()` (ConfigurationManager.java:60-63)
serializes the entire `ProxyConfig` to JSON with no masking; (3)
`Configuration.merge()` and `mergeIfExist()` (Configuration.java:325,339) log
`"Replace, key: {}, value: {} -> {}"` with old/new values and no masking; (4)
`AdminBrokerProcessor.java:1141` logs the full incoming `Properties` object on
runtime config updates with no masking. No masking/redaction logic exists
anywhere in the codebase.
**Affected Files:** **
common/src/main/java/org/apache/rocketmq/common/MixAll.java,
remoting/src/main/java/org/apache/rocketmq/remoting/Configuration.java,
broker/src/main/java/org/apache/rocketmq/broker/processor/AdminBrokerProcessor.java,
broker/src/main/java/org/apache/rocketmq/broker/BrokerStartup.java,
proxy/src/main/java/org/apache/rocketmq/proxy/ProxyStartup.java,
proxy/src/main/java/org/apache/rocketmq/proxy/config/ConfigurationManager.java,
proxy/src/main/java/org/apache/rocketmq/proxy/config/ProxyConfig.java,
common/src/main/java/org/apache/rocketmq/common/BrokerConfig.java,
auth/src/main/java/org/apache/rocketmq/auth/config/AuthConfig.java
**Analysis:** ** The issue is valid. Sensitive configuration fields such as
`ProxyConfig.tlsKeyPassword` (line 84), `ProxyConfig.metricsGrpcExporterHeader`
(line 246), `BrokerConfig.metricsGrpcExporterHeader` (line 407), and
`AuthConfig.innerClientAuthenticationCredentials` (line 39) are printed in full
to normal log files during Broker/Proxy startup and Broker runtime
configuration updates. The existing `configBlackList` mechanism only prevents
*updating* certain configs via the admin API — it does not prevent *logging*
them. There is no annotation, marker, or masking utility to protect sensitive
values in log projections.
I'll prepare a fix spec and work on a PR. The community is welcome to
provide feedback on the approach before implementation.
---
🤖 *Automated issue analysis by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
