zmuxuny opened a new pull request, #6927:
URL: https://github.com/apache/rocketmq-dashboard/pull/6927
### Brief Description
Bound the datasource connection-test and notification webhook HTTP response
bodies to **5 MiB (5,242,880 bytes)**, matching the existing Prometheus
metrics-query budget.
A shared interceptor runs before Spring's string conversion and HTTP error
handling. It rejects an oversized advertised Content-Length, and otherwise
reads at most the limit plus one byte, so missing or understated lengths are
handled consistently. Accepted responses retain their status, headers and body;
rejected responses close their streams and responses.
Datasource tests report a specific size-limit failure. Webhook delivery uses
the existing retry/exhaustion policy. Timeouts, URL validation and redirect
behavior are unchanged. The server README documents the boundary.
### How Did You Test This Change?
Verified on `rocketmq-studio@c34535db0819d02f68e50a856cb3d2614f0dc5dd`,
using Temurin 21.0.12.1 and Maven 3.9.11.
```
cd server
mvn -B -ntp \
-Dtest=BoundedResponseBodyInterceptorTest,SettingsServiceTest,NotificationResponseBodyLimitTest,NotificationOutboxServiceTest,DataSourceClientHttpRequestFactoryTest
\
test
```
- Focused matrix: **119 tests, 0 failures, 0 errors, 0 skipped**.
- Checkstyle: **0 violations**; `git diff --check` passes.
- Coverage includes success/error statuses, exact-limit acceptance,
absent/understated Content-Length, bounded incremental reads, stream/response
cleanup, small error details, timeout/redirect behavior, and notification
retry/exhaustion.
- Negative control: the 14 new service-level size-limit cases fail against
unchanged production sources at the base commit (14 assertion failures, 0
errors), and pass with the patch.
Runner details: Maven/test heaps were capped at 512 MiB and Mockito was
attached with `-javaagent`. The existing `NotificationOutboxServiceTest` mock
fixtures use `example.com`; the cloud runner's DNS environment rejects that
name before the mocked request. For the 119-test run only,
`-Djdk.net.hosts.file=<test-hosts-file>` mapped it to the documentation address
`192.0.2.1`. No OS hosts file was changed. The new response-limit tests use
numeric documentation addresses and pass without this override; all HTTP
responses are in-process fixtures.
No live integration endpoint, full MySQL-backed backend suite, frontend
build or production deployment was exercised locally. CI status should be
assessed on this PR's actual head.
### Checklist
- [x] One coherent change; no unrelated refactor or dependency change
- [x] Conventional commit subject
- [x] Regression tests use the `...Test` naming convention
- [x] New source files carry ASF license headers
- [x] Changed behavior documented in `server/README.md`
AI assistance was used for implementation, independent code review and test
execution.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
