zjncs opened a new pull request, #4194: URL: https://github.com/apache/rocketmq-dashboard/pull/4194
### Motivation `MybatisPlusCloudCredentialRepository.findPage` feeds the trimmed search term straight into a `LIKE` clause over the credential `name`. Because `%` and `_` are SQL LIKE wildcards, a term like `aliyun_prod%` matches every credential whose name starts with `aliyun` + any single character + `prod`, plus any suffix — silently listing credentials the user did not type. ### Changes - Add a private `escapeLike` helper (same behaviour as the existing `QueryHistoryService.escapeLike`) and apply it to the normalized search term in `findPage`. ### Verification `MybatisPlusCloudCredentialRepositoryTest` — new test `findPageShouldEscapeLikeWildcardsInTheSearchTerm` asserts the bound LIKE value for `aliyun_prod%` is `%aliyun\_prod\%%` and not the unescaped pattern. Before the fix it fails; after it the class is green (6/6). ``` $ mvn -f server/pom.xml test -Dtest='MybatisPlusCloudCredentialRepositoryTest' (before) Tests run: 6, Failures: 1, Errors: 0 (after) Tests run: 6, Failures: 0, Errors: 0 ``` This is the same class of fix as the audit (`MybatisPlusAuditRepository`) and instance (`MybatisPlusInstanceRepository`) search paths, which also bind user input into LIKE clauses without escaping. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
