Aias00 commented on issue #2337:
URL:
https://github.com/apache/rocketmq-dashboard/issues/2337#issuecomment-5324003549
Additional scope correction: the affected
`RocketMQMessageProvider.viewMessageByOffsetId` method is shared by more than
the administrator-only AI tool gateway.
On the vulnerable `rocketmq-studio` baseline, authenticated reader users can
reach it through:
- `GET /api/messages?instanceId=...&topic=...&msgId=...`
- `GET /api/messages/{msgId}/trace?instanceId=...&topic=...`
`AuthInterceptor` permits ordinary GET routes to reader users. Both paths
pass the supplied offset-style ID into the same provider method, which decodes
the embedded IP/port and makes the direct RocketMQ remoting call. This changes
the affected role from administrator to authenticated reader.
PR #2339 performs the broker-membership validation inside that shared
provider method, so the existing repair protects both the AI and reader
endpoints. Please use this corrected scope when evaluating the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
