[studio][ISSUE #10901] Harden Proxy metrics header parsing

[messere1]

What changed

• parse metrics labels and OTLP exporter headers at the first colon only
• trim keys and values while preserving additional colons in values
• skip entries with a missing separator or blank key
• report only the invalid entry position, without echoing the configured header string
• add focused tests for colon-containing values, whitespace, empty values, and malformed entries

Why

Proxy metrics initialization previously used String.split(:). Valid header values containing colons were discarded, and malformed OTLP header warnings logged the complete configuration, which can include authorization tokens or API keys.

Impact

The change is local to Proxy metrics key/value parsing. It does not alter exporter defaults, protocols, or public APIs.

Fixes #10901

Validation

• mvn -pl proxy -Dtest=ProxyMetricsManagerTest -Djacoco.skip=true test
  • 3 tests, 0 failures, 0 errors
  • Checkstyle: 0 violations
  • SpotBugs: 0 issues

JaCoCo is skipped locally because the repository's JaCoCo 0.8.5 agent does not support Java 17 class files.

[RockteMQ-AI]

Summary

This PR extracts the duplicated header/label parsing logic in ProxyMetricsManager into a reusable parseKeyValuePairs() method that correctly handles values containing colons (e.g., URLs, Bearer tokens) by splitting on the first colon only. The previous String.split(":") approach would silently drop or misparse such values.

The refactoring is clean, well-tested with focused edge-case tests (colon-containing values, whitespace handling, empty values, malformed entries), and improves information security by not echoing raw header strings in warnings.

LGTM.

---

Automated review by RockteMQ-AI · Community Assistant