[ISSUE #10762] Avoid exposing RemoteChannel extend attribute

[Aias00]

Fixes #10762.

What changed

• Stop including raw extendAttribute in RemoteChannel.toString().
• Keep diagnostic signal through extendAttributePresent and extendAttributeLength.
• Add regression coverage to ensure the raw attribute is not exposed.

Validation

• JAVA_HOME=$(/usr/libexec/java_home -v 1.8) mvn -pl proxy -Dtest=RemoteChannelTest test

[Copilot]

🟢 Ready to approve

The change aligns with the issue’s safety requirements and includes regression coverage; only a minor toString() consistency nit was noted.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR hardens RemoteChannel.toString() to avoid leaking potentially sensitive extendAttribute contents into logs/diagnostics, while preserving a lightweight diagnostic signal (presence + length) and adding regression coverage.

Changes:

• Remove raw extendAttribute from RemoteChannel.toString() output.
• Add extendAttributePresent and extendAttributeLength diagnostics instead.
• Add a unit test to ensure the raw attribute is not exposed.

File summaries

File	Description
proxy/src/main/java/org/apache/rocketmq/proxy/processor/channel/RemoteChannel.java	Replaces extendAttribute in toString() with presence + length fields to prevent sensitive data exposure.
proxy/src/test/java/org/apache/rocketmq/proxy/processor/channel/RemoteChannelTest.java	Adds regression test asserting toString() does not include the raw extendAttribute and includes the new diagnostics.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[RockteMQ-AI]

Review by github-manager-bot

Summary

Replaces raw extendAttribute exposure in RemoteChannel.toString() with safe diagnostic signals (extendAttributePresent and extendAttributeLength), preventing sensitive configuration data from leaking into logs.

Findings

• [Info] proxy/src/main/java/.../channel/RemoteChannel.java:113-114 — Clean approach: preserving diagnostic utility (presence + length) while eliminating the data leak. The null-safe ternary for extendAttributeLength is correct.
• [Info] proxy/src/test/java/.../channel/RemoteChannelTest.java — Good regression test that asserts both the negative (sensitive data absent) and positive (diagnostic signals present) properties.

Verdict

Straightforward security hardening with proper test coverage. LGTM.

---

Automated review by github-manager-bot

[codecov-commenter]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 48.24%. Comparing base (89166af) to head (11b8fd4).

Files with missing lines	Patch %	Lines
...ocketmq/proxy/processor/channel/RemoteChannel.java	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             develop   #10763      +/-   ##
=============================================
- Coverage      48.29%   48.24%   -0.06%     
+ Complexity     13499    13486      -13     
=============================================
  Files           1380     1380              
  Lines         101093   101094       +1     
  Branches       13102    13104       +2     
=============================================
- Hits           48821    48769      -52     
- Misses         46304    46338      +34     
- Partials        5968     5987      +19     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.