coder999o opened a new issue, #7290: URL: https://github.com/apache/rocketmq-dashboard/issues/7290
### Before Creating the Bug Report - [x] Searched open/closed issues and all-state PRs for ACL risk diagnostics and empty account whitelists. - [x] This is a RocketMQ Studio diagnostic defect. - [x] The source reproduction uses the rocketmq-studio commit below. ### Studio Version `rocketmq-studio`, commit `127c47b06a268cc74224d5f34c56ec7c36ac0d55`. ### Runtime Environment Source-based reproduction and local TypeScript/jsdom tests; no deployed Studio or live Broker verification is claimed. ### Connected RocketMQ Cluster No cluster is needed to reproduce the diagnostic calculation. The affected input is the Plain Access account configuration displayed on the ACL page. ### Describe the Bug An empty account-level `whiteRemoteAddress` means no source-address restriction (`AclUserVO` documents this explicitly; `AclService.splitWhiteList` returns an empty list). However, `accountWhitelistClass` passes the empty list to the generic whitelist classifier, whose default is `scoped`. An administrator account without a source restriction can therefore be shown as healthy with score 100 and broadWhitelistCount 0, instead of reporting the existing unrestricted-account and broad-administrator findings. This affects diagnostic reporting, not Broker authorization enforcement. ### Steps to Reproduce Call `analyzeAclRisk` with ACL enabled, ACL 2.0, an empty global whitelist, and one account with a non-empty access key, `admin: true`, `defaultTopicPerm: DENY`, `defaultGroupPerm: DENY`, and `whiteRemoteAddress` omitted, null, empty, or whitespace-only. Other permissions can be ordinary resource-scoped PUB/SUB entries. ### What Did You Expect to See? `BROAD_ACCOUNT_WHITELIST` and `ADMIN_WITH_BROAD_ACCESS`, a critical risk status, and broadWhitelistCount 1. An empty global whitelist should retain its existing semantics: no globally trusted addresses. ### What Did You See Instead? Neither finding is emitted; the unrestricted administrator can receive healthy/100 and broadWhitelistCount 0. ### Additional Context The fix can distinguish the account-level empty value in `accountWhitelistClass`, preserving the generic/global whitelist behavior and reusing the existing findings and empty-value evidence text. No API, storage, or enforcement change is needed. ### Are You Willing to Submit a Pull Request? - [x] Yes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
