tju-yxq opened a new issue, #5501:
URL: https://github.com/apache/rocketmq-dashboard/issues/5501
## Problem
Two settings forms store copy-pasted values without trimming, and the
backend does **no normalization** in either flow:
1. **Cloud credentials** (`CloudCredentialTab.tsx`): `accessKey`,
`secretKey`, and `name` go from the form to
`createCloudCredential`/`updateCloudCredential` verbatim. Cloud IAM consoles
and password managers routinely add invisible leading/trailing whitespace when
copying; the backend (`CloudCredentialService.java`) has **zero** `.trim()`
calls — the padded credential is stored as-is, and every subsequent cloud API
call signs with it and fails authentication. The `secretKey` field is a masked
`Input.Password`, so the padding is invisible to the user and the failure looks
like a wrong key.
2. **Data source URL** (`DataSourceTab.tsx`): the URL guard
(`UrlHostGuard.java:55`) strips only its validation copy (`url.strip()`); the
stored value passes through raw (`SettingsService.java:238-249`) and feeds
`MetricsSourceFactory.java:45` (`baseUrl(config.getUrl())`) — every metrics
query against a padded URL fails with a malformed-base-URL error, while the
connection test (which strips) passed at save time.
Both pages already trim their own search boxes (`search.trim()`), so the
omission is an oversight, not a convention.
## What did you do (steps to reproduce)?
1. Copy an access key from a cloud console that includes a trailing newline;
paste it into the cloud credential form with its secret; save.
2. The credential is stored padded (backend verifies the key exists but does
not strip); every subsequent cloud operation that uses it fails authentication.
3. Similarly: save a Prometheus data source with a URL that has a leading
space — the guard validates (it strips its own copy), the save succeeds, and
every metrics query fails.
## What did you expect to see?
Credentials and connection strings that arrive by copy-paste are trimmed at
the form boundary before storage.
## What did you see instead?
Padded values stored verbatim; downstream authentication and connection
failures that are invisible at the point of entry.
## Root cause
`CloudCredentialTab.tsx` handleSubmit (around line 186):
```ts
await createCloudCredential({ name: values.name, vendor: values.vendor,
accessKey: values.accessKey ?? '', secretKey: values.secretKey ?? '', ...
});
```
`DataSourceTab.tsx` handleSubmit (around line 246):
```ts
const values = await dsForm.validateFields(saveFieldNames);
const dataSourceValues = withoutSecrets(values); // url rides through raw
```
## Expected behavior
- Cloud credential `accessKey`, `secretKey`, and `name` are trimmed before
create/update; the blank-secret-on-update semantics (`undefined` means "keep
the current secret") are preserved.
- Data source `url` and `name` are trimmed before create/update.
## Acceptance criteria
- [ ] A padded pasted AK/SK is stored trimmed; the connection test and
subsequent cloud operations succeed.
- [ ] The update flow's blank-secret-means-unchanged behavior is preserved
(still `undefined`, not `''`).
- [ ] A padded data source URL is stored trimmed; metrics queries succeed
against it.
- [ ] All existing form behaviors (validation, editing, secret round-trip)
are unchanged.
## Environment
Branch `rocketmq-studio` at `6a68042f`; files:
`web/src/pages/settings/CloudCredentialTab.tsx`,
`web/src/pages/settings/DataSourceTab.tsx`.
## Duplicate check
Searched open and closed issues for `credential trim`, `padded access key`,
and `datasource url`: nothing covers the missing trim in these two settings
flows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
