This is an automated email from the ASF dual-hosted git repository.
RongtongJin pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/rocketmq.git
The following commit(s) were added to refs/heads/develop by this push:
new 23aaa3e7cb fix(tools): stop trimming the ACL password in mqadmin
create/updateUser (#11447)
23aaa3e7cb is described below
commit 23aaa3e7cbe086b89a82aa20e95b87b27fc36ccf
Author: bai mengxuan <[email protected]>
AuthorDate: Mon Oct 26 14:52:26 2026 +0800
fix(tools): stop trimming the ACL password in mqadmin create/updateUser
(#11447)
The secret is a payload, not a name: the broker stores the secret verbatim
and derives the
client's credentials from it, so a passphrase with leading or trailing
whitespace is legal -
and pasted secrets routinely carry one. CreateUserSubCommand and
UpdateUserSubCommand ran it
through StringUtils.trim before the call, which stores a secret the
operator never typed:
every client that presents the real secret is then rejected with no hint
about the
difference. The sendMessage body carried the same shape until #11414.
Drop the trim on the password only - the username, user type and address
keep theirs - and
give both commands the createAdminExt seam CopyUsersSubCommand already
exposes, so the
behaviour is pinned by a test.
---
.../tools/command/auth/CreateUserSubCommand.java | 10 +++-
.../tools/command/auth/UpdateUserSubCommand.java | 10 +++-
.../command/auth/CreateUserSubCommandTest.java | 67 ++++++++++++++++++++++
.../command/auth/UpdateUserSubCommandTest.java | 67 ++++++++++++++++++++++
4 files changed, 150 insertions(+), 4 deletions(-)
diff --git
a/tools/src/main/java/org/apache/rocketmq/tools/command/auth/CreateUserSubCommand.java
b/tools/src/main/java/org/apache/rocketmq/tools/command/auth/CreateUserSubCommand.java
index 7dad3d6dfc..0d02b07e3f 100644
---
a/tools/src/main/java/org/apache/rocketmq/tools/command/auth/CreateUserSubCommand.java
+++
b/tools/src/main/java/org/apache/rocketmq/tools/command/auth/CreateUserSubCommand.java
@@ -73,12 +73,14 @@ public class CreateUserSubCommand implements SubCommand {
public void execute(CommandLine commandLine, Options options,
RPCHook rpcHook) throws SubCommandException {
- DefaultMQAdminExt defaultMQAdminExt = new DefaultMQAdminExt(rpcHook);
+ DefaultMQAdminExt defaultMQAdminExt = createAdminExt(rpcHook);
defaultMQAdminExt.setInstanceName(Long.toString(System.currentTimeMillis()));
try {
String username =
StringUtils.trim(commandLine.getOptionValue('u'));
- String password =
StringUtils.trim(commandLine.getOptionValue('p'));
+ // The secret is a payload, not a name: leading or trailing spaces
are part of it, and
+ // trimming it here stores a secret the operator never typed.
+ String password = commandLine.getOptionValue('p');
String userType =
StringUtils.trim(commandLine.getOptionValue('t'));
if (commandLine.hasOption('b')) {
@@ -110,4 +112,8 @@ public class CreateUserSubCommand implements SubCommand {
defaultMQAdminExt.shutdown();
}
}
+
+ DefaultMQAdminExt createAdminExt(RPCHook rpcHook) {
+ return new DefaultMQAdminExt(rpcHook);
+ }
}
diff --git
a/tools/src/main/java/org/apache/rocketmq/tools/command/auth/UpdateUserSubCommand.java
b/tools/src/main/java/org/apache/rocketmq/tools/command/auth/UpdateUserSubCommand.java
index ef8544f2c0..4b9088bae1 100644
---
a/tools/src/main/java/org/apache/rocketmq/tools/command/auth/UpdateUserSubCommand.java
+++
b/tools/src/main/java/org/apache/rocketmq/tools/command/auth/UpdateUserSubCommand.java
@@ -78,12 +78,14 @@ public class UpdateUserSubCommand implements SubCommand {
public void execute(CommandLine commandLine, Options options,
RPCHook rpcHook) throws SubCommandException {
- DefaultMQAdminExt defaultMQAdminExt = new DefaultMQAdminExt(rpcHook);
+ DefaultMQAdminExt defaultMQAdminExt = createAdminExt(rpcHook);
defaultMQAdminExt.setInstanceName(Long.toString(System.currentTimeMillis()));
try {
String username =
StringUtils.trim(commandLine.getOptionValue('u'));
- String password =
StringUtils.trim(commandLine.getOptionValue('p'));
+ // The secret is a payload, not a name: leading or trailing spaces
are part of it, and
+ // trimming it here stores a secret the operator never typed.
+ String password = commandLine.getOptionValue('p');
String userType =
StringUtils.trim(commandLine.getOptionValue('t'));
String userStatus =
StringUtils.trim(commandLine.getOptionValue('s'));
@@ -115,4 +117,8 @@ public class UpdateUserSubCommand implements SubCommand {
defaultMQAdminExt.shutdown();
}
}
+
+ DefaultMQAdminExt createAdminExt(RPCHook rpcHook) {
+ return new DefaultMQAdminExt(rpcHook);
+ }
}
diff --git
a/tools/src/test/java/org/apache/rocketmq/tools/command/auth/CreateUserSubCommandTest.java
b/tools/src/test/java/org/apache/rocketmq/tools/command/auth/CreateUserSubCommandTest.java
new file mode 100644
index 0000000000..32c3feb536
--- /dev/null
+++
b/tools/src/test/java/org/apache/rocketmq/tools/command/auth/CreateUserSubCommandTest.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.tools.command.auth;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Options;
+import org.apache.rocketmq.remoting.RPCHook;
+import org.apache.rocketmq.tools.admin.DefaultMQAdminExt;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+public class CreateUserSubCommandTest {
+ private static final String BROKER = "127.0.0.1:10911";
+ private static final String USERNAME = "bob";
+ private static final String PASSWORD = " s3cret ";
+
+ private DefaultMQAdminExt adminExt;
+ private CommandLine commandLine;
+ private CreateUserSubCommand command;
+
+ @Before
+ public void setUp() {
+ adminExt = mock(DefaultMQAdminExt.class);
+ commandLine = mock(CommandLine.class);
+ command = new CreateUserSubCommand() {
+ @Override
+ DefaultMQAdminExt createAdminExt(RPCHook rpcHook) {
+ return adminExt;
+ }
+ };
+ when(commandLine.hasOption('b')).thenReturn(true);
+ when(commandLine.getOptionValue('b')).thenReturn(BROKER);
+ when(commandLine.getOptionValue('u')).thenReturn(USERNAME);
+ when(commandLine.getOptionValue('p')).thenReturn(PASSWORD);
+ }
+
+ @Test
+ public void testCreateKeepsThePasswordVerbatim() throws Exception {
+ command.execute(commandLine, new Options(), null);
+
+ ArgumentCaptor<String> password =
ArgumentCaptor.forClass(String.class);
+ verify(adminExt).createUser(eq(BROKER), eq(USERNAME),
password.capture(), any());
+ Assert.assertEquals(PASSWORD, password.getValue());
+ }
+}
diff --git
a/tools/src/test/java/org/apache/rocketmq/tools/command/auth/UpdateUserSubCommandTest.java
b/tools/src/test/java/org/apache/rocketmq/tools/command/auth/UpdateUserSubCommandTest.java
new file mode 100644
index 0000000000..dd8b494618
--- /dev/null
+++
b/tools/src/test/java/org/apache/rocketmq/tools/command/auth/UpdateUserSubCommandTest.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.tools.command.auth;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Options;
+import org.apache.rocketmq.remoting.RPCHook;
+import org.apache.rocketmq.tools.admin.DefaultMQAdminExt;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+public class UpdateUserSubCommandTest {
+ private static final String BROKER = "127.0.0.1:10911";
+ private static final String USERNAME = "bob";
+ private static final String PASSWORD = " p@ss word ";
+
+ private DefaultMQAdminExt adminExt;
+ private CommandLine commandLine;
+ private UpdateUserSubCommand command;
+
+ @Before
+ public void setUp() {
+ adminExt = mock(DefaultMQAdminExt.class);
+ commandLine = mock(CommandLine.class);
+ command = new UpdateUserSubCommand() {
+ @Override
+ DefaultMQAdminExt createAdminExt(RPCHook rpcHook) {
+ return adminExt;
+ }
+ };
+ when(commandLine.hasOption('b')).thenReturn(true);
+ when(commandLine.getOptionValue('b')).thenReturn(BROKER);
+ when(commandLine.getOptionValue('u')).thenReturn(USERNAME);
+ when(commandLine.getOptionValue('p')).thenReturn(PASSWORD);
+ }
+
+ @Test
+ public void testUpdateKeepsThePasswordVerbatim() throws Exception {
+ command.execute(commandLine, new Options(), null);
+
+ ArgumentCaptor<String> password =
ArgumentCaptor.forClass(String.class);
+ verify(adminExt).updateUser(eq(BROKER), eq(USERNAME),
password.capture(), any(), any());
+ Assert.assertEquals(PASSWORD, password.getValue());
+ }
+}
