89799969 opened a new issue, #4232:
URL: https://github.com/apache/rocketmq-dashboard/issues/4232

   ## Problem
   
   Alert-rule inventory search treats `%` and `_` as SQL LIKE wildcards instead 
of literal characters:
   
   - `GET /api/alert-rules/page?search=` / `GET 
/api/business-alert-rules/page?search=` filter `name` with unescaped `LIKE` 
(`MybatisPlusAlertRepository.ruleQuery`).
   - Domain-scoped paging (`AlertRuleQuery.search`, used by the paged 
alert-rule feed) filters `name` and `metric` the same way 
(`MybatisPlusAlertRepository.findRulesPage`).
   
   Alert-rule names and metric identifiers commonly contain underscores 
(`consumer_lag`, `disk_usage`). Searching for `consumer_lag` therefore also 
matches `consumerXlag`, and a trailing `%` matches any suffix — so the 
inventory silently returns unrelated rules or hides the intended one.
   
   ## Evidence
   
   `MybatisPlusAlertRepository.ruleQuery` 
(`server/src/main/java/org/apache/rocketmq/studio/ops/alert/MybatisPlusAlertRepository.java:75-80`)
 passes the search term straight into `.like(name, search)`.
   
   `MybatisPlusAlertRepository.findRulesPage` (`:83-101`) does the same for 
both `name` and `metric` after only trimming the term.
   
   The same class of defect was already fixed for query history 
(`QueryHistoryService.escapeLike`) and is being fixed for ACL inventory (#4229 
/ #4230), Studio user search, instance / audit / cloud-credential search; 
alert-rule search is the remaining high-traffic search surface with the gap.
   
   ## Impact
   
   Operators cannot reliably look up the alert rule they mean when the name or 
metric contains `_` or `%`. In a shared Studio with many rules this produces 
wrong rows and can hide the intended rule.
   
   ## Expected behavior
   
   User-supplied `search` terms are matched literally. Escape `\`, `%`, and `_` 
before building the LIKE pattern (same convention as 
`QueryHistoryService.escapeLike`). Blank/null filters keep their current 
no-filter semantics.
   
   ## Acceptance criteria
   
   - Regression tests prove a term such as `consumer_lag%` is bound as 
`%consumer\_lag\%%` rather than `%consumer_lag%`.
   - Cover both the legacy name-only page search and the domain page 
name/metric search.
   - Do not change the public API contract.
   
   ## Related work
   
   #2265 / `QueryHistoryService.escapeLike` established the escape convention. 
Open peers: #4229/#4230 (ACL inventory), #4223/#4224 (Studio user search), 
instance / audit / cloud-credential LIKE PRs.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to