lizhimins commented on PR #4969:
URL:
https://github.com/apache/rocketmq-dashboard/pull/4969#issuecomment-5806618912
Closing this one: it does not compile against the current branch, and the
capability it adds already exists.
1. `AclRuleVO` has no `sourceIp` field and its `id` is a `Long` (see
`AclRuleVO.java:32-41`). `AclSecurityAuditor` reads `rule.getSourceIp()` and
assigns `rule.getId()` to a `String`, and `AclSecurityAuditorTest` builds rules
with `.id("rule-1").sourceIp("*")` — both the engine and its tests fail to
compile. The fixtures hide a field that does not exist in the domain model.
2. ACL risk auditing is already implemented and shipped:
`web/src/utils/aclRiskDiagnostics.ts` (557 lines) classifies open whitelists
(`*`, `0.0.0.0/0`, `::/0`, `0/0`), broad CIDR prefixes, wildcard topic/group
permissions, default-allow accounts, duplicate access keys and multiple admins,
and `web/src/pages/instance/acl.tsx` renders it. `IpRangeMatcher` already does
the CIDR/wildcard matching server side — the new `parseIntervals` only
understands exact IPs, `a.b.c.d-e` ranges and `.*`, so real CIDR rules silently
escape overlap detection.
3. `AclService.auditAclRules` calls `aclRepository.findRulePage(null, null,
null, null, null, 1, 1000)`: the `instanceId` parameter is validated but never
used as a filter, so the audit reports rules from every instance and is
silently capped at 1000 rows.
4. All five test methods in `AclSecurityAuditorTest` are named `testXxx`;
the project convention is a `...Test` suffix.
5. The new `GET /api/acl/rules/audit` endpoint is not added to
`docs/api-spec.md`, where the other ACL rule endpoints are catalogued.
If you still see a gap here, please start from the existing
`aclRiskDiagnostics` rule set (and `IpRangeMatcher`) rather than a parallel
engine, and make the finding model part of that shared contract.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
