89799969 opened a new pull request, #4230: URL: https://github.com/apache/rocketmq-dashboard/pull/4230
## What is the purpose of the change Fixes #4229. ACL inventory search treats `%` and `_` as SQL LIKE wildcards instead of literal characters: - `GET /api/acl/users/page?keyword=` filters `username` and `access_key` with unescaped `LIKE` (`MybatisPlusAclRepository.findUserPage`). - `GET /api/acl/rules/page?principal=` / `?resource=` filter `principal` and `resource` the same way (`MybatisPlusAclRepository.ruleQuery`). Usernames and ACL principals commonly contain underscores (`svc_monitor`, `prod_user`). Searching for `prod_user` therefore also matches `prodXuser`, and a trailing `%` matches any suffix — so the inventory silently returns unrelated accounts or rules. ## Brief changelog - Add a private `escapeLike` helper (same behaviour as the existing `QueryHistoryService.escapeLike`) and apply it to user-page keywords and rule-page principal/resource filters. - Two regression tests assert the bound LIKE value for `prod_user%` / `svc_monitor%` is escaped (`%prod\_user\%%`) rather than treated as a wildcard pattern. ## Verifying this change ``` $ mvn -f server/pom.xml test -Dtest='Acl*Test,MybatisPlusAclRepositoryTest' [INFO] Tests run: 118, Failures: 0, Errors: 0, Skipped: 0 [INFO] BUILD SUCCESS ``` Checkstyle: 0 violations (module validate phase). Before the fix the two new tests fail because the bound parameters are `%prod_user%` / `%svc_monitor%`; after it they bind `%prod\_user\%%` / `%svc\_monitor\%%`. Related peers: #4192–#4194 (audit / instance / cloud-credential LIKE escape), #4223/#4224 (Studio user search). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
