unbridled-41 commented on PR #6007: URL: https://github.com/apache/rocketmq-dashboard/pull/6007#issuecomment-6090926445
### Follow-up review of this fix: the update path writes the same columns The bounds only covered `create`. `update` writes `name`, `secret_key` and `remark` to the very same columns, so an over-long value there still reached the database first and its rejection still came back as a generic 500 — the symptom this PR reports, on the endpoint the UI actually uses to rename a credential or rotate its secret. `remark` had no bound on `create` either (`rmq_cloud_credential.remark` is `VARCHAR(255)`, and the repository persists it in both paths). Commit `0f43cc39` closes that in this branch (first commit `65024b67` untouched, no force-push): - extracted `requireSecretWithinColumn` (the base64 width rule) so both paths share it, and added `remark` ≤ 255 to `create`; - applied all three bounds in `update` **before** mutating the stored credential, so a rejected request leaves the row untouched and never reaches `credentialRepository.replace`; - messages stay field-specific: `Cloud credential name must not exceed 128 characters`, `… secretKey encodes to more than 512 characters`, `… remark must not exceed 255 characters`. Tests: the existing `createShouldRejectFieldsThatExceedTheirColumnsTest` now also covers `remark`, and a new `updateShouldRejectFieldsThatExceedTheirColumnsTest` drives all three fields through `update` and asserts `replace` / `invalidateCredential` are never called. Red/green, both observed locally: ``` # with the update bounds removed cd server && mvn -o -B -ntp test -Dtest='CloudCredentialServiceTest#updateShouldRejectFieldsThatExceedTheirColumnsTest' Tests run: 1, Failures: 1, Errors: 0, Skipped: 0 <<< FAILURE! (BUILD FAILURE) # with 0f43cc39 cd server && mvn -o -B -ntp test -Dtest='CloudCredentialServiceTest,CloudCredentialControllerTest' Tests run: 23, Failures: 0, Errors: 0, Skipped: 0 BUILD SUCCESS ``` Branch `fix/credential-secret-bounds`, HEAD `0f43cc39` (on top of `65024b67`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
