RockteMQ-AI commented on issue #2006: URL: https://github.com/apache/rocketmq-dashboard/issues/2006#issuecomment-5269996160
**Issue Evaluation** Category: `bug` (race condition) | Status: **Confirmed** The reported race condition has been verified against the current `rocketmq-studio` codebase. **Root Cause:** `AclService.updateUser()` performs a read-then-write pattern that is not atomic: 1. `findUserById()` loads the existing user (line ~85) 2. Fields are merged preserving credentials 3. `aclRepository.saveUser(merged)` is called In `MybatisPlusAclRepository.saveUser()`, a second `selectById()` check determines whether to `updateById()` or `insert()`. If a concurrent delete removes the row between steps 1 and 3, the `selectById()` returns null and the code falls through to `insert()`, recreating the user with stale credentials. **Impact:** ACL user identity/credentials can be silently resurrected after an authorized deletion, with a misleading success audit entry. **Severity:** Medium — requires precise timing but has security implications (deleted credentials reappearing). **Suggested fix direction:** Replace the dual-check pattern in `saveUser()` with an update-only operation when called from `updateUser()`, or use a database-level `UPDATE ... WHERE id = ?` that returns affected row count. Return structured 404 when zero rows are affected. An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation. --- *Automated evaluation by @RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
