This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 6ce131b1f fix(acl): reject zero-only plain address ranges (#7315)
6ce131b1f is described below
commit 6ce131b1f77c76a03dc5e9b6cfafb2e745f251fc
Author: Xiao Yang <[email protected]>
AuthorDate: Mon Oct 26 16:38:25 2026 +0800
fix(acl): reject zero-only plain address ranges (#7315)
* fix(acl): reject zero-only plain address ranges
---
.../instance/acl/PlainAclRemoteAddressValidator.java | 4 +++-
.../rocketmq/studio/instance/acl/AclServiceTest.java | 8 ++++++--
.../instance/acl/PlainAclRemoteAddressValidatorTest.java | 16 ++++++++++++++++
3 files changed, 25 insertions(+), 3 deletions(-)
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidator.java
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidator.java
index 283a273b2..45c95c207 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidator.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidator.java
@@ -211,7 +211,9 @@ final class PlainAclRemoteAddressValidator {
try {
int start = Integer.parseInt(startValue, radix);
int end = Integer.parseInt(endValue, radix);
- return start <= end && end <= maximum;
+ // The broker only initializes a range when its upper bound is
positive. A zero-only
+ // range can fail matching or widen a trailing wildcard; use a
literal zero instead.
+ return start <= end && end > 0 && end <= maximum;
} catch (NumberFormatException ignored) {
return false;
}
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclServiceTest.java
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclServiceTest.java
index f1213d4ae..9618d89d3 100644
---
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclServiceTest.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclServiceTest.java
@@ -1022,7 +1022,9 @@ class AclServiceTest {
}
@ParameterizedTest
- @ValueSource(strings = {"999.999.999.999", "10.0.0.0/8",
"192.168.100-1.*", "192.168.1.{}"})
+ @ValueSource(strings = {"999.999.999.999", "10.0.0.0/8",
"192.168.100-1.*", "192.168.1.{}",
+ "192.168.1.0-0", "192.168.0-0.*", "192.168.1.000-000",
"192.168.000-000.*",
+ "2001:db8::0-0", "2001:db8::0-0:*", "2001:db8::0000-0000",
"2001:db8::0000-0000:*"})
void
createAndUpdatePlainAccessConfigShouldRejectInvalidWhiteRemoteAddress(String
whiteRemoteAddress) {
PlainAccessConfigVO config = PlainAccessConfigVO.builder()
.accessKey("ak-1")
@@ -1039,7 +1041,9 @@ class AclServiceTest {
@ParameterizedTest
@ValueSource(strings = {"*", "192.168.*.*", "192.168.1-100.*",
"192.168.1.{1,2,3}",
- "192.168.1.10,192.168.1.11", "2001:db8::1"})
+ "192.168.1.10,192.168.1.11", "2001:db8::1",
+ "192.168.0.*", "192.168.0-1.*", "192.168.1-1.*", "192.168.1.0",
+ "2001:db8::0:*", "2001:db8::0-1:*", "2001:db8::1-1:*", "2001:db8::0"})
void
createAndUpdatePlainAccessConfigShouldAcceptValidWhiteRemoteAddress(String
whiteRemoteAddress) {
PlainAccessConfigVO config = PlainAccessConfigVO.builder()
.accessKey("ak-1")
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidatorTest.java
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidatorTest.java
index 22ce97d24..202a9175f 100644
---
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidatorTest.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidatorTest.java
@@ -30,6 +30,14 @@ class PlainAclRemoteAddressValidatorTest {
"127.0.0.1",
"192.168.*.*",
"192.168.1-100.*",
+ "192.168.0.*",
+ "192.168.0-1.*",
+ "192.168.1-1.*",
+ "192.168.1.0",
+ "2001:db8::0:*",
+ "2001:db8::0-1:*",
+ "2001:db8::1-1:*",
+ "2001:db8::0",
"192.168.1.{1,2,3}",
"192.168.1.10,192.168.1.11",
"*:*:*:*:*:*:*:*",
@@ -48,6 +56,14 @@ class PlainAclRemoteAddressValidatorTest {
"10.0.0.0/8",
"192.168.300.*",
"192.168.100-1.*",
+ "192.168.1.0-0",
+ "192.168.0-0.*",
+ "192.168.1.000-000",
+ "192.168.000-000.*",
+ "2001:db8::0-0",
+ "2001:db8::0-0:*",
+ "2001:db8::0000-0000",
+ "2001:db8::0000-0000:*",
"192.168.1.{}",
"192.168.1.{1,}",
"192.168.{1,2}.1",
