89799969 opened a new issue, #4232: URL: https://github.com/apache/rocketmq-dashboard/issues/4232
## Problem Alert-rule inventory search treats `%` and `_` as SQL LIKE wildcards instead of literal characters: - `GET /api/alert-rules/page?search=` / `GET /api/business-alert-rules/page?search=` filter `name` with unescaped `LIKE` (`MybatisPlusAlertRepository.ruleQuery`). - Domain-scoped paging (`AlertRuleQuery.search`, used by the paged alert-rule feed) filters `name` and `metric` the same way (`MybatisPlusAlertRepository.findRulesPage`). Alert-rule names and metric identifiers commonly contain underscores (`consumer_lag`, `disk_usage`). Searching for `consumer_lag` therefore also matches `consumerXlag`, and a trailing `%` matches any suffix — so the inventory silently returns unrelated rules or hides the intended one. ## Evidence `MybatisPlusAlertRepository.ruleQuery` (`server/src/main/java/org/apache/rocketmq/studio/ops/alert/MybatisPlusAlertRepository.java:75-80`) passes the search term straight into `.like(name, search)`. `MybatisPlusAlertRepository.findRulesPage` (`:83-101`) does the same for both `name` and `metric` after only trimming the term. The same class of defect was already fixed for query history (`QueryHistoryService.escapeLike`) and is being fixed for ACL inventory (#4229 / #4230), Studio user search, instance / audit / cloud-credential search; alert-rule search is the remaining high-traffic search surface with the gap. ## Impact Operators cannot reliably look up the alert rule they mean when the name or metric contains `_` or `%`. In a shared Studio with many rules this produces wrong rows and can hide the intended rule. ## Expected behavior User-supplied `search` terms are matched literally. Escape `\`, `%`, and `_` before building the LIKE pattern (same convention as `QueryHistoryService.escapeLike`). Blank/null filters keep their current no-filter semantics. ## Acceptance criteria - Regression tests prove a term such as `consumer_lag%` is bound as `%consumer\_lag\%%` rather than `%consumer_lag%`. - Cover both the legacy name-only page search and the domain page name/metric search. - Do not change the public API contract. ## Related work #2265 / `QueryHistoryService.escapeLike` established the escape convention. Open peers: #4229/#4230 (ACL inventory), #4223/#4224 (Studio user search), instance / audit / cloud-credential LIKE PRs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
