Frun1na opened a new issue, #6807: URL: https://github.com/apache/rocketmq-dashboard/issues/6807
### Before Creating the Bug Report - [x] I have searched the [open issues](https://github.com/apache/rocketmq-dashboard/issues) of this repository and believe that this is not a duplicate. - [x] This is a defect in RocketMQ Studio, not a usage question and not a defect in another Apache RocketMQ repository. - [x] I can reproduce this on the current `rocketmq-studio` branch, or I have stated the exact version I am running below. ### Studio Version branch: rocketmq-studio git commit id: a92c2314 deployed as: reproduced by a unit test against that commit ### Runtime Environment OS: not applicable — the defect is in the write path's input validation MySQL: not applicable — reproduced without a database, against the service browser (for UI issues): not required to observe it ### Connected RocketMQ Cluster not applicable — reproduced with a stubbed repository in a unit test ### Describe the Bug An ACL identity longer than the column that stores it is accepted by the ACL write paths and then fails inside the insert, so the caller gets a persistence-layer 500 instead of a validation error. `rmq_acl_user.username` and `rmq_acl_rule.principal` are both `VARCHAR(128)` (`server/src/main/resources/db/schema.sql:284` and `:267`), but nothing bounds the values that reach them: - The request DTOs validate only presence — `CreateAclUserDTO.username` and `UpdateAclUserDTO.username` carry `@NotBlank`, `CreateAclRuleDTO.principal` and `UpdateAclRuleDTO.principal` carry `@NotBlank`, and none of them carries a length constraint. - `AclService.createUser` / `updateUser` / `createRule` / `updateRule` check only that the value has text, then hand it to the repository. - `GlobalExceptionHandler` does not translate `DataIntegrityViolationException`, so MySQL's "Data too long for column" leaves the endpoint as a 500. The AI tool path cannot be closed by the request DTOs at all: `UserCreateToolHandler.execute` builds an `AclUserVO` in code and calls `AclService.createUser` directly, and the tool catalog declares only `minLength: 1` for that field, so a model can produce the too-long value. The console form has the same shape of gap. The project already treats this as a defect class on other columns: `#6087` bounded the topic/group registration text, `#6683` the certificate text, `#6007` the cloud-credential fields, and `#6796` the LLM model id — all for the same reason, and all counted in code points because that is the unit MySQL counts a `varchar` in. ### Steps to Reproduce ```text POST /api/acl/users/create {"username": "<129 characters>"} POST /api/acl/rules/create {"principal": "<129 characters>", "resource": "topic-1"} ``` Or as a unit test against the service: ```java aclService.createUser(AclUserVO.builder().username("u".repeat(129)).build(), null); // expected: BusinessException(400, "username must not exceed 128 characters") // actual: the guard is absent, the value reaches aclRepository.saveUser ``` ### What Did You Expect to See? The write is refused with `400` and the field's name, before anything reaches the database. ### What Did You See Instead? The value is accepted by every check on the way and the endpoint answers `500` from the persistence layer. ### Additional Context A fix with a regression test follows in a pull request. ### Are You Willing to Submit a Pull Request? - [x] Yes, I am willing to submit a pull request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
