X-LightYear opened a new issue, #4981: URL: https://github.com/apache/rocketmq-dashboard/issues/4981
### Studio Version Branch: `rocketmq-studio` Commit: `1ef5d860799ac3fabfcdea942cc4dcc77ded7be6` ### Describe the Bug The Apache ACL rule update service does not apply the same non-blank validation used by ACL rule creation. An update request with a whitespace-only `principal` or `resource` is allowed to proceed to repository lookup and can reach persistence when the ID exists. ### Steps to Reproduce 1. Use the Apache ACL path (not the Tencent provider path). 2. Call `AclService.updateRule` with an existing numeric rule ID, a whitespace-only `principal` or `resource`, and otherwise valid fields. 3. Observe that the update path does not reject the invalid field before repository access. Deterministic regression setup: ```text AclServiceTest#updateRuleShouldRejectBlankPrincipalBeforeRepositoryWrite input: id=1, principal=" ", resource="topic-1" ``` ### Expected Behavior The service rejects a blank or whitespace-only principal/resource with HTTP 400, matching `createRule`, and does not access the repository. ### Actual Behavior The update path skips principal/resource validation and proceeds to `aclRepository.replaceRule`. With a missing ID it reports `ACL rule not found: 1` rather than the input validation error; with an existing ID, invalid ACL metadata can be persisted. ### Root Cause `AclService.createRule` validates `principal` and `resource` using `StringUtils.hasText`, but the Apache branch of `AclService.updateRule` only validates the ID before replacing the stored rule. ### Scope This report concerns Apache ACL rule updates. Tencent updates remain provider-specific and are not part of the proposed change. ### Regression Evidence On the unmodified commit, the focused deterministic test fails: ```text Tests run: 1, Failures: 1, Errors: 0 expected: ACL principal is required actual: ACL rule not found: 1 ``` No live RocketMQ cluster or database is required for the service-level reproduction. ### Are You Willing to Submit a Pull Request? - [x] Yes -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
