This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new ac91364d1 fix(acl): reject IPv6 range expressions anchored on the
first group (#3308)
ac91364d1 is described below
commit ac91364d1567946d465ae89758c8d58d2d3c0b11
Author: Zhao Jianing <[email protected]>
AuthorDate: Mon Sep 7 16:33:11 2026 +0800
fix(acl): reject IPv6 range expressions anchored on the first group (#3308)
isValidIpv6Range uses split(":", -1), which keeps the empty tokens of a
leading "::". That lets the variable's array index satisfy the old
firstVariable <= 0 guard even when no concrete group precedes it, so
expressions such as "::*", "::1-20" and "::1-20:*" were accepted.
None of these can be used by the plain ACL address parser on the broker:
for "::*" and "::1-20" the legacy RemoteAddressStrategyFactory analysis
loop never runs over the single split token, producing a strategy with a
null head that throws on every match, and "::1-20:*" expands to a
0:0 head that silently widens the whitelist beyond the written range.
Track how many concrete groups precede the variable and require at
least one, mirroring the prefix the plain ACL range strategy needs.
---
.../studio/instance/acl/PlainAclRemoteAddressValidator.java | 7 ++++++-
.../studio/instance/acl/PlainAclRemoteAddressValidatorTest.java | 3 +++
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidator.java
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidator.java
index 54d6ffb07..283a273b2 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidator.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidator.java
@@ -152,6 +152,7 @@ final class PlainAclRemoteAddressValidator {
}
String[] segments = expression.split(":", -1);
int nonEmptySegments = 0;
+ int prefixGroups = 0;
int firstVariable = -1;
for (int i = 0; i < segments.length; i++) {
String segment = segments[i];
@@ -166,6 +167,7 @@ final class PlainAclRemoteAddressValidator {
continue;
}
if (firstVariable < 0 && ("*".equals(segment) ||
isValidRange(segment, 16, 0xffff))) {
+ prefixGroups = nonEmptySegments - 1;
firstVariable = i;
continue;
}
@@ -174,7 +176,10 @@ final class PlainAclRemoteAddressValidator {
}
return false;
}
- if (firstVariable <= 0 || nonEmptySegments > 8) {
+ // split(":", -1) keeps the empty tokens of a leading "::", so the
variable's array index
+ // alone cannot prove a concrete prefix exists. Expressions like "::*"
or "::1-20" anchor
+ // the range on the first group and cannot be used by the plain ACL
address parser.
+ if (prefixGroups < 1 || nonEmptySegments > 8) {
return false;
}
String variable = segments[firstVariable];
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidatorTest.java
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidatorTest.java
index 792c9851e..22ce97d24 100644
---
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidatorTest.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/PlainAclRemoteAddressValidatorTest.java
@@ -56,6 +56,9 @@ class PlainAclRemoteAddressValidatorTest {
"2001:db8::gggg",
"1050::0005:0600:300c:200-1",
"1050::0005:*:300c:1",
+ "::*",
+ "::1-20",
+ "::1-20:*",
"not-an-address"
})
void shouldRejectExpressionsThePlainAclParserCannotUse(String expression) {
