unbridled-41 opened a new issue, #2834: URL: https://github.com/apache/rocketmq-dashboard/issues/2834
## Problem The DLQ resend endpoints (`POST /api/dlq/resend`, `POST /api/dlq/resend-selected`) accept a user-controlled `targetTopic` that overrides the resolved destination of dead letters. `RocketMQDLQProvider.resolveTargetTopic` returns this value **verbatim** and `resendOne` sends to it with `producer.send()` — with no format, system-topic, or existence validation. `DLQResendRequestDTO.targetTopic` carries no validation constraints either. ## Impact An admin (or any code path that forwards the request body) can make Studio: 1. **Feed dead letters back into their own DLQ**: `targetTopic = "%DLQ%<sameGroup>"` (or the group's `%RETRY%` topic) re-appends every resent dead letter into the very topic being drained. Repeated invocations or an automation loop grow the DLQ unboundedly while the response reports `SUCCESS`. 2. **Poison broker system topics**: `RMQ_SYS_TRACE_TOPIC` (trace poisoning — fake produce/consume records appear in every message trace), `SCHEDULE_TOPIC_XXXX`, `RMQ_SYS_TRANS_HALF_TOPIC`, `TBW102`, etc. Messages sent into system topics interfere with broker-internal processing and are visible to every other tenant of the cluster. 3. **Silently create topics**: on clusters with `autoCreateTopicEnable=true`, resending to any non-existent name creates a new 8/8-queue topic as a side effect of "resend", bypassing the audited topic-creation flow. 4. **Invalid names**: topic strings that the broker will reject (whitespace, control characters) are only discovered per message after the send attempt. All of this happens without any guard at the service boundary, while the explicit topic-creation flow is admin-gated and audited. ## Suggested fix Validate the explicit `targetTopic` once at the resend entry points, before scanning/dispatching: - reject names failing `TopicValidator.validateTopic` (format/length); - reject system, `%RETRY%` and `%DLQ%` topics via the existing `SystemTopicFilter.isSystem`; - require the topic to exist on the selected instance (`fetchAllTopicList`) so resend cannot be used as an implicit topic-creation primitive. Legitimate cross-topic resend (re-driving dead letters to an existing business topic) stays supported. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
