89799969 opened a new issue, #4223:
URL: https://github.com/apache/rocketmq-dashboard/issues/4223
## Problem
`AuthService.listUsers` passes the raw username search into MyBatis-Plus
`like("username", normalizedSearch)` without escaping SQL LIKE wildcards. A
search for `admin_` matches `adminX`, `admin1`, etc.; a search for `admin%`
matches any suffix.
Instance, credential, and operation-audit search paths already escape `\`,
`%`, and `_` (see #4192–#4194). The studio user search path does not.
## Evidence
```java
String normalizedSearch = search == null ? "" : search.trim();
// ...
.like(!normalizedSearch.isEmpty(), "username", normalizedSearch)
```
`AuthService.java` `listUsers`.
## Expected behavior
Username search matches the literal search string. `_` and `%` in the query
are not treated as wildcards.
## Scope
`AuthService.listUsers` + focused unit regression test. No API change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
