btlqql opened a new pull request, #4290:
URL: https://github.com/apache/rocketmq-dashboard/pull/4290
## What is the purpose of the change
The audit log search value reaches the repository unmodified and is used as
a LIKE pattern over
`operator`, `resource_name` and `detail`. MyBatis-Plus wraps it as
`%<search>%`, so the caller's `%`
and `_` keep their SQL wildcard meaning:
- `search=%` matches every row (`LIKE '%%'`);
- `search=_` matches every row whose column is a non-empty string;
- `search=100%_done` matches any row that merely *contains* `100` followed
by four arbitrary
characters, instead of the rows that contain the literal text.
The same value drives the insight aggregates and the CSV export —
`AuditService.exportLogs` reuses
`findPage` — so the list, the summary and the exported file are all wrong in
the same way, and a
full-table match can push the export over its 10 000-record cap and fail it
with a 400 where the
filtered subset would have fitted.
The fix escapes the search once per query builder, with the backslash
convention the repository
already uses for the message query history search
(`QueryHistoryService:353`) — MySQL treats a
backslash as the default LIKE escape character, so no `ESCAPE` clause is
needed and a literal
backslash in the search is matched as a literal backslash too.
## Brief changelog
- `MybatisPlusAuditRepository`: added `escapeLike` and applied it in both
places that build the
search predicate — `findPage` and the shared `applyFilters` used by
`summarize`/`exportLogs`.
- `MybatisPlusAuditRepositoryTest`: two new cases — `findPage` with
`100%_done` and `summarize` with
`a_b%`; both assert the bound LIKE parameters are `%100\%\_done%` /
`%a\_b\%%`, on every query the
summary issues (four `selectMaps` aggregates plus the `selectList` lookup).
## Verification
Red first, on the unmodified implementation with only the new tests added:
```
mvn -f server/pom.xml -B -Dtest=MybatisPlusAuditRepositoryTest
-DfailIfNoTests=false test
[ERROR] Tests run: 11, Failures: 2, Errors: 0, Skipped: 0, Time elapsed:
0.902 s <<< FAILURE! -- in
org.apache.rocketmq.studio.ops.audit.MybatisPlusAuditRepositoryTest
java.lang.AssertionError:
Expecting ArrayList:
["%100%_done%", "%100%_done%", "%100%_done%"]
to contain only:
["%100\%\_done%"]
element(s) not found:
["%100\%\_done%"]
and element(s) not expected:
["%100%_done%", "%100%_done%", "%100%_done%"]
[ERROR] Tests run: 11, Failures: 2, Errors: 0, Skipped: 0
[INFO] BUILD FAILURE
```
Green after the change:
```
[INFO] Tests run: 11, Failures: 0, Errors: 0, Skipped: 0, Time elapsed:
0.876 s -- in
org.apache.rocketmq.studio.ops.audit.MybatisPlusAuditRepositoryTest
[INFO] BUILD SUCCESS
```
Whole backend suite (`mvn -f server/pom.xml -B test`): `Tests run: 2153,
Failures: 5, Errors: 5,
Skipped: 0` — the same ten ids that fail on the unmodified base `6c24d2ed`
(`Tests run: 2151, Failures: 5, Errors: 5`): eight need a POSIX `sh` CLI
this Windows machine does
not have (`CliAgentProviderTest`, `ClaudeCodeAgentProviderTest`) and two are
the
`AuthCorsIntegrationTest` cases aligned separately in #4217. No other test
moved.
Only the query wrappers are asserted, as in the existing tests of this
class; no MySQL instance is
available here, so the escaping is verified at the point where the value is
bound.
Fixes #4289
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
