zjncs opened a new pull request, #4193: URL: https://github.com/apache/rocketmq-dashboard/pull/4193
### Motivation The instance search box passes its raw keyword into `LIKE` clauses over `name`, `endpoint` and `remark` (`MybatisPlusInstanceRepository.search` / `findByTypeAndSearch`, reached from `InstanceService.listInstances` for the instance list page). Since `_` and `%` are SQL LIKE wildcards: - an underscore in an instance name (very common, e.g. `prod_cluster_1`) silently matches *any* single character, so searching `prod_cluster_1` also returns `prod-cluster-1`, `prodXclusterY1`, … - a trailing `%` (e.g. pasted from a log line) matches every suffix. So the search can silently return instances that do not contain the typed text at all. ### Changes - Add a private `escapeLike` helper (same behaviour as the existing `QueryHistoryService.escapeLike`) and apply it to the keyword in both `search` and `findByTypeAndSearch`. ### Verification `MybatisPlusInstanceRepositoryTest` — two new tests: - `searchShouldEscapeLikeWildcardsTest` - `findByTypeAndSearchShouldEscapeLikeWildcardsTest` Both assert the bound LIKE value for `prod_cluster%` is `%prod\_cluster\%%` and not the unescaped pattern. Before the fix both fail; after it the class is green (18/18). ``` $ mvn -f server/pom.xml test -Dtest='MybatisPlusInstanceRepositoryTest' (before) Tests run: 18, Failures: 2, Errors: 0 (after) Tests run: 18, Failures: 0, Errors: 0 ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
