123123213weqw opened a new pull request, #7064: URL: https://github.com/apache/rocketmq-dashboard/pull/7064
Supersedes #4714 (stale-bot closed, authored by @btlqql — credited below) — same fix, merged onto the current `rocketmq-studio` (clean; auth and this limiter are unchanged on base since the original), with the regression suite expanded. Co-authored-by: btlqql <[email protected]> ## The bug The login rate limiter's exact-tracker slots free themselves through `clearOverflowAttempts()`, which wiped the **entire** overflow tracker unconditionally — so the moment any slot refilled, a live 5-failure lock on a *different* username was cancelled and the blocked attacker could retry immediately. ## The fix All three slot-freeing callers (`recordSuccess`, `activeExactState`, `reclaimExpiredExactAttemptsIfDue`) now use `clearStaleOverflowAttempts(now)`, which skips the wipe while any overflow lock is still `lockedAt(now)`; overflow state carrying no lock is still dropped, so episode cleanup is unchanged. ## Tests Five new cases in `LoginRateLimiterTest` (driven by the existing `MutableClock`): a refill must not release an active overflow lock; a lookup of an expired username must not release another user's lock; slot-freeing still drops overflow state that carries no lock; a successful login must not release another user's lock; and a successful login still drops lock-free state. Mutation check: with the base class restored and the new tests kept, exactly the three lock-preservation tests fail and both controls stay green — the tests detect precisely the defect. Suite is 17/17 on the current base. cc @lizhimins -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
