youngkermit8-coder opened a new issue, #1689:
URL: https://github.com/apache/rocketmq-dashboard/issues/1689
## Security bug
`AuthInterceptor.isCredentialRevealPath` compares the raw servlet path with
`endsWith("/credentials")`, while Spring MVC removes matrix parameters when
matching controller routes.
A request such as `GET /api/acl/users/user-1/credentials;probe=1` therefore
still invokes the credential-reveal controller, but the interceptor no longer
recognizes it as an administrator-only path. An authenticated non-admin reader
can use this mismatch to reach both ACL-user and cloud-credential secret
endpoints.
## Reproduction
1. Enable login and authenticate as a configured non-admin reader.
2. Request either:
- `/api/acl/users/{id}/credentials;probe=1`
- `/api/cloud-credentials/{id}/credentials;probe=1`
3. Observe HTTP 200 and controller execution instead of HTTP 403.
A focused MockMvc reproduction on current `rocketmq-studio` resolves both
requests to their credential controllers and returns 200.
## Expected behavior
Credential-reveal endpoints must remain administrator-only regardless of
legal matrix parameters. Authorization matching should use the same path
semantics as Spring MVC before checking the protected suffix.
## Proposed scope
- strip matrix-parameter content from each path segment before the
administrator-only GET check;
- keep ordinary credential paths and unrelated reader GET endpoints
unchanged;
- add end-to-end authorization regressions for both secret endpoints,
including positive administrator coverage.
## Duplicate check
Searched open and closed issues and pull requests for semicolon paths,
matrix parameters/variables, credential authorization bypasses, and
administrator-only credential paths. No matching contribution was found.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
