[Bug] Avoid exposing RemoteChannel extendAttribute in toString
- Dominant language
- Java
- Stars
- 22.6k
- Forks
- 12k
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 27
Description
### Problem
`RemoteChannel.toString()` currently includes the complete `extendAttribute` value. For gRPC clients this attribute may contain serialized channel settings or other runtime metadata. If a `RemoteChannel` is included in logs or diagnostics, the full attribute can be exposed unintentionally.
### Evidence
`proxy/src/main/java/org/apache/rocketmq/proxy/processor/channel/RemoteChannel.java` currently renders:
`extendAttribute` directly in `toString()`.
### Expected behavior
`RemoteChannel.toString()` should keep useful diagnostics such as channel id, protocol type, and remote proxy IP, but should not include the raw `extendAttribute` content. A presence flag and length are sufficient for debugging most cases.
### Scope
This is in the Proxy / Studio track scope for safer client/runtime diagnostics. The proposed fix is a small logging/stringification hardening change and does not change channel serialization, decoding, or runtime behavior.
Contributor guide
Research direction
Start in proxy/src/main/java/org/apache/rocketmq/proxy/processor/channel/RemoteChannel.java and inspect its toString() implementation. Keep the channel id, protocol type, and remote proxy IP in the diagnostics while ensuring the raw extendAttribute content is absent; a presence flag and length are sufficient.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java
- Domain
- backend, networking
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100