btlqql opened a new issue, #4289:
URL: https://github.com/apache/rocketmq-dashboard/issues/4289
## 1. Symptom
`GET /api/audit/logs?search=...`, `GET /api/audit/summary?search=...` and
`GET /api/audit/logs/export?search=...` pass the search box value to the
audit repository unmodified,
where it is used as a LIKE pattern across three columns. `%` and `_`
therefore keep their SQL
wildcard meaning instead of matching those characters literally:
- `search=%` matches every audit row (`LIKE '%%'`).
- `search=_` matches every row whose `operator`, `resource_name` or `detail`
is a non-empty string.
- `search=100%_done` matches any row where one of the three columns merely
contains `100`
followed by four arbitrary characters, instead of the rows that contain
the literal text.
## 2. Root cause
`server/src/main/java/org/apache/rocketmq/studio/ops/audit/MybatisPlusAuditRepository.java:60-64`
(list view)
and `:200-203` (every aggregate/insight query, shared by the export through
`AuditService.exportLogs`):
```java
QueryWrapper<RmqOperationAudit> query = new
QueryWrapper<RmqOperationAudit>()
.and(StringUtils.hasText(search), w -> w
.like("operator", search)
.or().like("resource_name", search)
.or().like("detail", search))
```
MyBatis-Plus wraps the value as `%<search>%`, and nothing escapes the value
first. The repository
already contains the escape convention for another search:
`QueryHistoryService:353` escapes `\`,
`%` and `_` before building its pattern.
## 3. Impact
- A search for a literal `%` or `_` silently widens the result set instead
of narrowing it, which is
exactly the case a user is looking for when they type those characters
(SQL text, wildcard-ish
resource names, `a_b` style ids).
- `search=_` turns the list view, the insights (`summarize`) and the CSV
export into full-table
dumps. The export is capped at 10 000 records and fails with a 400 above
that, so a full-table
match can make the export fail instead of returning the filtered subset.
## 4. Reproduction
1. Open the audit log page with any filters that produce rows.
2. Search for `_`: the response contains every row with a non-empty
operator/resource/detail,
instead of only the rows that contain an underscore.
3. `GET /api/audit/summary?search=%` returns the same totals as no filter at
all.
## 5. Expected behaviour
- `%` and `_` in the search box are matched as literal characters in
`operator`, `resource_name`
and `detail`; a backslash in the search is treated as a literal backslash
as well.
- The escaping applies to every query built from the search value, so the
list, the insights and the
CSV export agree with each other.
- Searching for a term without wildcards behaves exactly as before.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
