youngkermit8-coder opened a new pull request, #1691:
URL: https://github.com/apache/rocketmq-dashboard/pull/1691
## Summary
- normalize matrix-parameter content before checking administrator-only
credential paths;
- keep both ACL-user and cloud-credential secret views protected when
semicolon parameters appear on any path segment;
- add controller-level authorization regressions for reader rejection and
administrator access.
## Root cause
The authorization interceptor compared the raw servlet path with
`endsWith("/credentials")`, while Spring MVC removes matrix parameters when
matching routes. A path such as `/api/acl/users/user-1/credentials;probe=1`
therefore still reached the credential controller, but no longer matched the
interceptor's administrator-only suffix check.
## Impact
Authenticated non-admin readers can no longer bypass credential-view
authorization with legal matrix parameters. Administrators retain access, and
unrelated read-only routes keep their existing policy.
## Reproduction and validation
- both new reader regressions first failed on exact upstream `65d1c32`,
resolving to the credential controllers and returning HTTP 200;
- focused authorization integration test: 3/3 passed after the fix;
- authentication and credential-controller regression set: 67/67 passed;
- Checkstyle reported 0 violations;
- `mvn -DskipTests package` succeeded.
Closes #1689
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
