apache / apache/rocketmq

[Bug] Avoid exposing RemoteChannel extendAttribute in toString

Open Beginner friendly
#10,762 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
22.6k
Forks
12k
Avg merge
3d 1h
Merged PRs (30d)
27

Description

### Problem

`RemoteChannel.toString()` currently includes the complete `extendAttribute` value. For gRPC clients this attribute may contain serialized channel settings or other runtime metadata. If a `RemoteChannel` is included in logs or diagnostics, the full attribute can be exposed unintentionally.

### Evidence

`proxy/src/main/java/org/apache/rocketmq/proxy/processor/channel/RemoteChannel.java` currently renders:

`extendAttribute` directly in `toString()`.

### Expected behavior

`RemoteChannel.toString()` should keep useful diagnostics such as channel id, protocol type, and remote proxy IP, but should not include the raw `extendAttribute` content. A presence flag and length are sufficient for debugging most cases.

### Scope

This is in the Proxy / Studio track scope for safer client/runtime diagnostics. The proposed fix is a small logging/stringification hardening change and does not change channel serialization, decoding, or runtime behavior.

Contributor guide

Open the contributing guide

Research direction

Start in proxy/src/main/java/org/apache/rocketmq/proxy/processor/channel/RemoteChannel.java and inspect its toString() implementation. Keep the channel id, protocol type, and remote proxy IP in the diagnostics while ensuring the raw extendAttribute content is absent; a presence flag and length are sufficient.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, java
Domain
backend, networking
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.