RockteMQ-AI commented on issue #4229:
URL:
https://github.com/apache/rocketmq-dashboard/issues/4229#issuecomment-5634245000
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The reported issue has been verified against the `rocketmq-studio` branch
(commit `36126024`).
**Root Cause:**
`MybatisPlusAclRepository.findUserPage` (line 113–114) passes the raw
keyword into `.like("username", search).or().like("access_key", search)`
without escaping SQL LIKE wildcards. `ruleQuery` (line 368–369) does the same
for `principal` and `resource`:
```java
// findUserPage — line 113-114
.and(search != null, w -> w
.like("username", search) // ← unescaped
.or().like("access_key", search)) // ← unescaped
// ruleQuery — line 368-369
.like(StringUtils.hasText(principal), "principal", principal) // ←
unescaped
.like(StringUtils.hasText(resource), "resource", resource) // ←
unescaped
```
The established fix pattern already exists in
`QueryHistoryService.escapeLike()` (line 346–351):
```java
private static String escapeLike(String search) {
return search.replace("\\", "\\\\").replace("%", "\\%").replace("_",
"\\_");
}
```
**Impact:** Usernames and ACL principals commonly contain underscores
(`svc_monitor`, `prod_user`). Searching for `prod_user` also matches
`prodXuser`, producing incorrect results and potentially exposing other
accounts access keys in the page listing.
**Severity:** Medium-High — ACL search is a security-sensitive surface;
incorrect results could show unrelated accounts credentials.
**Affected Files:**
-
`server/src/main/java/org/apache/rocketmq/studio/instance/acl/MybatisPlusAclRepository.java`
An automated fix proposal will be generated. Reply `/approve` to proceed
with PR generation.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
