RockteMQ-AI commented on issue #4498:
URL:
https://github.com/apache/rocketmq-dashboard/issues/4498#issuecomment-5711862809
**Issue Evaluation**
Category: `bug` | Status: **Evaluated**
## Analysis: Issue #4498
**1. Type:** Bug — confirmed.
**2. Codebase verification:** Confirmed on `master`.
- `AliyunClientFactory.call`
(server/src/main/java/org/apache/rocketmq/studio/provider/alibaba/AliyunClientFactory.java:84)
returns `future.get(...)` directly without inspecting the response body. A
normally completed future with `success=false` is treated as success.
- `AliyunInstanceProvider` discards mutation responses entirely:
- Topic create / update / delete (lines 243, 261, 273)
- Consumer Group create / delete (lines 361, 392)
- `resetOffset` (line 452)
- Existing tests in `AliyunClientFactoryTest` only cover exception mapping
and a successful `ListRegions` read response; no mutation-response validation
exists.
**3. Severity:** High. False control-plane success allows Studio to update
UI and write SUCCESS audit logs for failed Aliyun mutations. Offset reset
failure being hidden is particularly dangerous.
**4. Suggested action:** Implement response validation and tests.
- Introduce a validation helper (in `AliyunClientFactory` or a small
utility) that checks mutation response bodies:
- null/incomplete body → `BusinessException(502, ...)`
- `success != true` → `BusinessException(502, ...)` with provider
`code`/`message`
- resource mutations also require `data == true`
- Update the six affected `AliyunInstanceProvider` mutation paths to capture
the response and validate it before returning success.
- Add unit tests returning normally completed SDK responses with
`success=false` / `data=false` and assert they fail closed, while preserving
existing successful and exception paths.
No frontend contract change is needed.
---
*Automated evaluation by RockteMQ-AI*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
