(rocketmq-dashboard) branch rocketmq-studio updated: fix(message): reject negative queue coordinates (#2561)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new adbeb772f fix(message): reject negative queue coordinates (#2561)
adbeb772f is described below

commit adbeb772fac46627cc80ed8144b4b409884852ad
Author: yyqdbngt <btl...@gmail.com>
AuthorDate: Tue Aug 25 17:35:56 2026 +0800

    fix(message): reject negative queue coordinates (#2561)
---
 .../rocketmq/studio/instance/message/MessageService.java |  6 ++++++
 .../studio/instance/message/MessageServiceTest.java      | 16 ++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/instance/message/MessageService.java
 
b/server/src/main/java/org/apache/rocketmq/studio/instance/message/MessageService.java
index e707d7dd6..5a185795d 100644
--- 
a/server/src/main/java/org/apache/rocketmq/studio/instance/message/MessageService.java
+++ 
b/server/src/main/java/org/apache/rocketmq/studio/instance/message/MessageService.java
@@ -91,6 +91,12 @@ public class MessageService {
         if (!StringUtils.hasText(brokerName)) {
             throw new BusinessException(400, "brokerName is required");
         }
+        if (queueId < 0) {
+            throw new BusinessException(400, "queueId must not be negative");
+        }
+        if (offset < 0) {
+            throw new BusinessException(400, "offset must not be negative");
+        }
         return messageProvider.pullMessageAtOffset(instanceId, topic, 
brokerName, queueId, offset);
     }
 
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/instance/message/MessageServiceTest.java
 
b/server/src/test/java/org/apache/rocketmq/studio/instance/message/MessageServiceTest.java
index 2c7a9bfc8..7c3ef6c11 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/instance/message/MessageServiceTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/instance/message/MessageServiceTest.java
@@ -27,6 +27,22 @@ import static org.mockito.Mockito.when;
 
 class MessageServiceTest {
 
+    @Test
+    void rejectsNegativeQueueCoordinatesBeforeCallingProvider() {
+        MessageProvider provider = mock(MessageProvider.class);
+        MessageService service = new MessageService(provider, 
mock(InstanceProviderRegistry.class),
+                mock(QueryHistoryService.class));
+
+        assertThatThrownBy(() -> service.pullMessageAtOffset("instance-a", 
"TopicA", "broker-a", -1, 0))
+                .isInstanceOf(BusinessException.class)
+                .hasMessage("queueId must not be negative");
+        assertThatThrownBy(() -> service.pullMessageAtOffset("instance-a", 
"TopicA", "broker-a", 0, -1))
+                .isInstanceOf(BusinessException.class)
+                .hasMessage("offset must not be negative");
+
+        verifyNoInteractions(provider);
+    }
+
     @Test
     void rejectsKeyQueryWithoutTopicBeforeCallingProvider() {
         MessageProvider provider = mock(MessageProvider.class);