zmuxuny opened a new pull request, #4534: URL: https://github.com/apache/rocketmq-dashboard/pull/4534
### Which Issue(s) This PR Fixes - Fixes #4502 ### Brief Description `GET /api/clients` accepted a caller-supplied `namesrvAddr` and forwarded any nonblank value to `ClientProvider.findConnectionsAt`. The Apache provider then executes through `MqAdminExtFactory`, so a reader could make Studio attempt RocketMQ admin connections to endpoints that were never registered by an administrator. This change makes the existing NameServer registry the backend authorization boundary for address-based client diagnostics. The requested address list is normalized with the same `NamesrvAddrParser` used by registry create/update, then must exactly match a stored `rmq_nameserver.namesrv_addr` value before provider execution. Registered endpoints keep the existing workflow, including equivalent formatting such as host case, whitespace, comma/semicolon separators, and existing cluster/type filters. Malformed addresses remain 400; a well-formed but unregistered endpoint is rejected with 404 before `ClientProvider` / `MqAdminExtFactory` interaction. ### Red / Green Verification Baseline: `master@d50ffecc9d7e8f8f46da64198831bd7952e6974e`. Fail-before, Java 21: - Added a service regression requiring `10.0.9.9:9876` to be rejected before provider execution. - `ClientServiceTest`: **6 tests, exactly 1 failure**. - The new test failed with `Expecting code to raise a throwable`, proving current master delegated the arbitrary endpoint normally. Green, Java 21: - `ClientControllerTest,ClientServiceTest,NameserverRegistryServiceTest`: **31/31 passed**, 0 failures/errors. - Registry coverage verifies canonical normalization, unregistered rejection, and malformed-address rejection before database lookup. - Checkstyle: **0 violations**. - `mvn -B -ntp -DskipTests package`: **BUILD SUCCESS**. - `git diff --check`: clean. ### Compatibility / Risk No API schema, frontend, dependency, or cache-policy changes. The Clients page already supplies NameServer registry endpoints, so its normal path is unchanged. The new boundary only prevents direct callers from expanding Studio's outbound RocketMQ target set beyond administrator-registered endpoint lists. AI-assisted source audit, implementation and regression authoring; no live unregistered NameServer endpoint was contacted during verification. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
