lizhimins commented on PR #4666: URL: https://github.com/apache/rocketmq-dashboard/pull/4666#issuecomment-5845585560
Thanks — the defect is real: `AuthService.java:198` passes a raw `search` straight into a MyBatis-Plus `.like(...)`, which binds `%search%` with no `ESCAPE` clause, so `search=_` matches every non-empty username. We cannot take this one, because #4458 is already open on exactly this line and does it more completely. It routes all 25 `.like(...)` search call sites across 10 files through a new shared `common/util/SqlLikeUtils`, and deletes the two private `escapeLike` copies that exist today (`QueryHistoryService.java:353`, `MybatisPlusAiConversationRepository.java:126`). `git merge-tree` between the two branches reports a content conflict in both `AuthService.java` and `AuthServiceDatabaseTest.java`, so they cannot land independently. Two further problems with this patch on its own terms. It adds a third private `escapeLike` (`AuthService.java:655`), while the javadoc at `MybatisPlusAiConversationRepository.java:124` already records that a shared util is the intended direction. And it emits `\%` without naming the escape character, so the predicate is only correct on engines whose default `LIKE` escape is a backslash; #4458 spells `ESCAPE CHAR(92)`, which is valid on both H2 (the `dev` profile, `application-dev.yml:4`) and MySQL 8, including under `NO_BACKSLASH_ESCAPES`. Closing as superseded by #4458. If you would like to drive this, the useful contribution is to review #4458, or rebase on top of it and extend `SqlLikeUtils` rather than adding a per-file copy. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
