RockteMQ-AI commented on issue #4232:
URL:
https://github.com/apache/rocketmq-dashboard/issues/4232#issuecomment-5634238981
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The reported issue has been verified against the `rocketmq-studio` branch
(commit `36126024`).
**Root Cause:**
`MybatisPlusAlertRepository.ruleQuery` (line 75–80) passes the raw search
term into `.like("name", search)` without escaping SQL LIKE wildcards.
`findRulesPage` (line 83–101) does the same for both `name` and `metric` after
only trimming.
**Evidence from codebase:**
```java
// ruleQuery — line 75-80
private static QueryWrapper<RmqAlertRule> ruleQuery(String search, Boolean
enabled) {
return new QueryWrapper<RmqAlertRule>()
.like(StringUtils.hasText(search), "name", search) // ←
unescaped
...
}
```
The established fix pattern already exists in
`QueryHistoryService.escapeLike()` (line 346–351):
```java
private static String escapeLike(String search) {
return search.replace("\\", "\\\\").replace("%", "\\%").replace("_",
"\\_");
}
```
**Impact:** Alert-rule names and metric identifiers commonly contain
underscores (`consumer_lag`, `disk_usage`). Searching for `consumer_lag` also
matches `consumerXlag`, producing incorrect results.
**Severity:** Medium — affects operators managing many alert rules in shared
Studio instances.
**Affected Files:**
-
`server/src/main/java/org/apache/rocketmq/studio/ops/alert/MybatisPlusAlertRepository.java`
An automated fix proposal will be generated. Reply `/approve` to proceed
with PR generation.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
