yuluo-yx opened a new issue, #2698: URL: https://github.com/apache/rocketmq-dashboard/issues/2698
## Problem Metric query validation subtracts caller-controlled signed `long` timestamps before checking their order and maximum range. Extreme values can overflow: a reversed window can wrap to a small positive range, while an oversized ordered window can wrap negative and receive the wrong validation result. ## Reproduction Call the metrics query service with either of these windows: - `start = Long.MAX_VALUE`, `end = Long.MIN_VALUE` - `start = Long.MIN_VALUE`, `end = Long.MAX_VALUE` The subtraction no longer represents the actual ordering or duration. ## Expected behavior Compare the endpoints before arithmetic, enforce the 31-day limit without overflow, and continue accepting an exact 31-day window near the signed timestamp boundary. ## Scope Update the metrics query-window validation and add focused regression tests for reversed, oversized, and exact-boundary windows. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
