fix(日志): 截断在敏感值中间时遮盖尾部

java/src/main/java/com/payment/platform/core/log/SensitivePayloadRedactor.java

@@ -66,6 +66,13 @@ public final class SensitivePayloadRedactor {
                     + "(?:\"(?:[^\"\\\\]|\\\\.)*\""
                     + "|-?\\d+(?:\\.\\d+)?(?:[eE][+-]?\\d+)?|true|false|null)");
 
+    /**
+     * 截断点正好落在敏感值字符串内部时的尾部：值没有闭合引号，上面的成对规则匹配不到，
+     * 这里把该键冒号后的整段尾巴（到文本末尾）全部盖上。
+     */
+    private static final Pattern JSON_UNTERMINATED = Pattern.compile(
+            "(?i)(\"(?:" + KEY_ALTERNATION + ")\"\\s*:\\s*\")[^\"]*$");
+
     private static final ObjectMapper MAPPER = new ObjectMapper();
 
     private SensitivePayloadRedactor() {
@@ -92,7 +99,8 @@ public final class SensitivePayloadRedactor {
             }
         }
         String withoutQuoted = JSON_QUOTED.matcher(truncated).replaceAll("$1\"" + MASK + "\"");
-        return clamp(KEY_VALUE.matcher(withoutQuoted).replaceAll("$1=" + MASK));
+        String withoutTail = JSON_UNTERMINATED.matcher(withoutQuoted).replaceAll("$1" + MASK);
+        return clamp(KEY_VALUE.matcher(withoutTail).replaceAll("$1=" + MASK));
     }
 
     /** 星号比原值长时（如 {@code "S1"} → {@code "***"}），最终长度仍不得超过上限。 */

java/src/test/java/com/payment/platform/core/log/SensitivePayloadRedactorTest.java

@@ -133,6 +133,16 @@ class SensitivePayloadRedactorTest {
         assertFalse(out.contains("123456"), out);
     }
 
+    @Test
+    void 截断在敏感值中间时_尾部也被遮盖() {
+        String out = SensitivePayloadRedactor.redact("{\"a\":1,\"app_secret\":\"S1");
+
+        assertFalse(out.contains("S1"), "未闭合的敏感值前缀泄露了: " + out);
+        assertTrue(out.length() <= 2000, "实际长度 " + out.length());
+        // 正控：确认命中的是 app_secret 的尾部，而不是整段被丢掉
+        assertTrue(out.contains("\"app_secret\":\"***"), out);
+    }
+
     @Test
     void 非JSON回退_转义的JSON字符串值整段变星号() {
         String out = SensitivePayloadRedactor.redact(