lizhimins commented on PR #4116: URL: https://github.com/apache/rocketmq-dashboard/pull/4116#issuecomment-5694488961
Closing: the changed line is not reachable in production. `AuthService.java:535` is in the in-memory user branch, while the Spring wiring every deployment actually uses goes through `loginDatabaseUser`, so the constant-time comparison cannot protect a real login path. The patch also adds no test, and the commit subject is a `Signed-off-by:` line rather than a description. This is the second patch from you on an unreachable `AuthService` path (see also #4145). If you want to work on authentication timing, please start from the database-backed path and open an issue first so we can agree on the threat model. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
