zjncs opened a new pull request, #11065:
URL: https://github.com/apache/rocketmq/pull/11065
### Motivation
`AttributeParser.parseToMap` splits each `key=value` pair without a limit:
```java
String[] splits = kv.split(ATTR_KEY_VALUE_EQUAL_SIGN);
key = splits[0];
value = splits[1];
```
Two consequences for user-supplied attribute strings (reachable from
`mqadmin updateTopic -a ...` / `updateSubGroup -c ...` and from
`UpdateTopicRequestHeader.getAttributes()` off the wire):
1. `"+key1="` — Java's `split` drops the trailing empty string, so `splits`
has length 1 and `splits[1]` throws a raw `ArrayIndexOutOfBoundsException`
instead of parsing an empty value.
2. `"+key1=a=b"` — the value is silently truncated to `"a"` and the rest
discarded, with no error. Values containing `=` are realistic (e.g. base64 with
padding).
### Modifications
Split with a limit of 2, so the first `=` separates key from value and
everything after it stays in the value.
### Verification
Fail-before (new tests, run against the unpatched code):
```
Tests run: 9, Failures: 1 --
AttributeParserTest#parseToMap_ValueContainingEqualSign_ReturnsFullValue
expected:<{+key1=a=b}> but was:<{+key1=a}>
Tests run: 1, Failures: 0, Errors: 1 --
AttributeParserTest#parseToMap_EmptyValue_ReturnsEmptyValue
java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
```
Pass-after:
```
Tests run: 13, Failures: 0, Errors: 0, Skipped: 0 -- AttributeParserTest
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
