89799969 opened a new issue, #4229: URL: https://github.com/apache/rocketmq-dashboard/issues/4229
## Problem ACL inventory search treats `%` and `_` as SQL LIKE wildcards instead of literal characters: - `GET /api/acl/users/page?keyword=` filters `username` and `access_key` with unescaped `LIKE`. - `GET /api/acl/rules/page?principal=` / `?resource=` filter `principal` and `resource` the same way. Usernames and ACL principals commonly contain underscores (`svc_monitor`, `prod_user`). Searching for `prod_user` therefore also matches `prodXuser`, and a trailing `%` matches any suffix — so the inventory silently returns unrelated accounts or rules. ## Evidence `MybatisPlusAclRepository.findUserPage` (`server/src/main/java/org/apache/rocketmq/studio/instance/acl/MybatisPlusAclRepository.java:115-129`) lowercases the keyword and passes it straight into `.like(username, search).or().like(access_key, search)`. `MybatisPlusAclRepository.ruleQuery` (`:388-398`) does the same for `principal` and `resource`. The same class of defect was already fixed for query history (`QueryHistoryService.escapeLike`) and is being fixed for instance / audit / cloud-credential / Studio-user search; ACL inventory is the remaining high-traffic search surface with the gap. ## Impact Operators cannot reliably look up the ACL account or rule they mean when the identifier contains `_` or `%`. In a shared Studio with many service accounts this produces wrong rows (including other accounts' access keys in the page listing) and can hide the intended rule. ## Expected behavior User-supplied `keyword`, `principal`, and `resource` are matched literally. Escape `\`, `%`, and `_` before building the LIKE pattern (same convention as `QueryHistoryService.escapeLike`). Blank/null filters keep their current no-filter semantics. ## Acceptance criteria - Regression tests prove a keyword such as `prod_user%` is bound as `%prod\_user\%%` rather than `%prod_user%`. - Cover both the user page search and the rule page principal/resource search. - Do not change the public API contract. ## Related work #2265 / `QueryHistoryService.escapeLike` established the escape convention. Open peers: #4223 (Studio user search), instance / audit / cloud-credential LIKE PRs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
