yyqdbngt opened a new pull request, #2969:
URL: https://github.com/apache/rocketmq-dashboard/pull/2969
## Summary
`MybatisPlusSettingsRepository.findDataSources` built its inventory filters
with
raw LIKE patterns: the search term was wrapped with `%value%` and the type
filter interpolated `LOWER({0})` between the `"type":"` markers. `%` and `_`
in user input therefore acted as SQL wildcards — a search for `a_b` also
matched `axb`, and a type of `%` matched every data source. Both filters now
escape `\`, `%` and `_` in the user-supplied fragment and declare
`ESCAPE '\'` explicitly, so the fixed wildcard fragments around the pattern
keep their meaning while the user fragment stays literal.
## Why
The data source inventory is a settings-screen search box; its input is free
text, not an enum. Without escaping, wildcard characters in the query
over-match the JSON blob and the list shows unrelated rows, which looks like
broken filtering to the user.
## Testing
```
cd server && mvn -Dtest="MybatisPlusSettingsRepositoryTest" test
```
Tests run: 9, Failures: 0, Errors: 0, Skipped: 0
New regression test `shouldEscapeLikeWildcardsInDataSourceInventoryQueries`
captures the QueryWrapper built for a search of `a_b 100%` with a type of
`pro_%` and asserts both user fragments reach the statement with their
wildcards escaped and the clause declares an explicit escape character.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
