unbridled-41 opened a new issue, #5480:
URL: https://github.com/apache/rocketmq-dashboard/issues/5480
### Studio Version
branch: `rocketmq-studio` @ `6a68042f` (the revision verified; the branch is
based on it)
deployed as: built from source (unit test)
### Runtime Environment
Not environment-specific: the provider's destination validation.
### Connected RocketMQ Cluster
One NameServer serving several clusters, with a Studio instance bound to one
of them.
### Describe the Bug
`validateResendTargetTopic` — whose javadoc claims it restricts the target
to "valid, existing, non-system topics **on the selected instance**" — only
asks the NameServer-wide list: `admin.fetchAllTopicList()` returns every topic
of every cluster registered on that endpoint. The send then reuses the
instance's producer, which sets only the instance's `namesrvAddr`, and
`producer.send(message)` routes by topic name across the whole endpoint. A
`targetTopic` that exists only in a sibling cluster therefore passes validation
and the replayed messages are published there, while the API and the audit
record report success. Every sibling write path rejects exactly this through
`ApacheWriteTargetResolver.requireTopicRoute`.
### Steps to Reproduce
1. Instance A on `ns1:9876` bound to `cluster-a`; the same NameServer also
serves `cluster-b`.
2. `targetTopic=orders` exists only in `cluster-b`.
3. `POST /api/dlq/resend
{"instanceId":"A","groupName":"G","targetTopic":"orders"}` returns SUCCESS and
replays the dead letters into `cluster-b`'s `orders`.
### What Did You Expect to See?
A destination outside the dead-letter topic's cluster is refused with 409,
as `sendMessage`/`resetOffset`/`consumeMessageDirectly` already do.
### What Did You See Instead?
The messages are written into another cluster, audited as a success.
### Evidence
- `provider/apache/RocketMQDLQProvider.java` (`validateResendTargetTopic`,
`resendAll`), `provider/apache/ApacheWriteTargetResolver.java`
(`requireTopicRoute` and its javadoc),
`provider/apache/RocketMQAdminClientImpl.java` (the sibling calls).
- `cd server && mvn -o test -Dtest=RocketMQDLQProviderTest` — the added case
`resendRejectsATargetTopicThatResolvesToAnotherClusterTest` fails before the
change (the resend proceeds into the foreign cluster) and passes after (`Tests
run: 46`), asserting the 409 and that no producer was engaged.
### Impact
Dead letters are silently republished into a cluster the operator did not
select.
### Acceptance Criteria
- The destination's route is compared with the dead-letter topic's, and a
mismatch answers 409.
- A regression test stubs both routes.
Related: #2834 (the earlier report that added the name/system/existence
validation this change extends with cluster confinement).
**Corresponding PR:** #5451
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
