btlqql opened a new pull request, #4684:
URL: https://github.com/apache/rocketmq-dashboard/pull/4684
<!-- Base branch: `rocketmq-studio`, the RocketMQ Studio trunk. -->
### Brief Description
`AuthService.validateLogin`
(server/src/main/java/org/apache/rocketmq/studio/auth/AuthService.java:554)
checked only that the submitted username was non-blank. An unauthenticated
caller could therefore send
a username of any length; the value was handed unchanged to
`findUserByUsername` and, when the login
failed, stored by `LoginRateLimiter.recordFailure` as an in-memory map key.
`LoginRateLimiter` bounds how many usernames it tracks
(`MAX_TRACKED_USERNAMES = 10_000`), never how
long they are, so the oversized string stayed reachable in that map for the
whole failure window
(5 minutes, plus the lazy sweep) - the one place in the login path whose
memory was not bounded. No
other username entry point accepts such a value: `CreateStudioUserDTO`
(`@Size(max = 128)`),
`AuthService.validateUsername` and the column (`username VARCHAR(128)` in
`server/src/main/resources/db/schema.sql:20`) all cap it at 128 characters.
`validateLogin` now enforces the same bound on the trimmed username and
rejects longer input with
`400` before the mapper and before the rate limiter see it. The check shares
one constant with
`validateUsername` so the two entry points cannot drift apart. Anything a
licence-holding client can
send today still behaves exactly as before: a username longer than 128
characters cannot exist in the
database, so no account answer changes.
### How Did You Test This Change?
Two new tests in `AuthServiceDatabaseTest`. The first pins the response
(400, and no mapper call), the
second pins the effect on the rate limiter by injecting a `LoginRateLimiter`
and reading its
package-private `trackedUsernameCount()` after a failed login with a
4096-character username.
Before the fix (red), on the unmodified tree:
```
$ cd server && mvn -B -ntp test
-Dtest='AuthServiceDatabaseTest#loginShouldRejectAnOverlongUsernameBeforeTouchingTheDatabase+anOverlongUsernameIsNeverRetainedAsARateLimiterKey'
[ERROR] Tests run: 2, Failures: 2, Errors: 0, Skipped: 0
[ERROR]
org.apache.rocketmq.studio.auth.AuthServiceDatabaseTest.loginShouldRejectAnOverlongUsernameBeforeTouchingTheDatabase
-- Time elapsed: 0.032 s <<< FAILURE!
Multiple Failures (1 failure)
-- failure 1 --
expected: 400
but was: 401
at
AuthServiceDatabaseTest.loginShouldRejectAnOverlongUsernameBeforeTouchingTheDatabase(AuthServiceDatabaseTest.java:570)
[ERROR]
org.apache.rocketmq.studio.auth.AuthServiceDatabaseTest.anOverlongUsernameIsNeverRetainedAsARateLimiterKey
-- Time elapsed: 2.531 s <<< FAILURE!
expected: 0
but was: 1
at
AuthServiceDatabaseTest.anOverlongUsernameIsNeverRetainedAsARateLimiterKey(AuthServiceDatabaseTest.java:599)
```
The `401` is the base behaviour: the 129-character name went to the mapper
lookup and came back as
"Invalid username or password", and the `4096`-character name was still
tracked by the rate limiter
afterwards.
After the fix (green) - the whole class, plus the neighbouring
login/rate-limiter classes:
```
$ cd server && mvn -B -ntp test
-Dtest='AuthServiceDatabaseTest,AuthServiceTest,LoginRateLimiterTest,AuthControllerTest'
[INFO] Tests run: 9, Failures: 0, Errors: 0, Skipped: 0 -- in
org.apache.rocketmq.studio.auth.AuthControllerTest
[INFO] Tests run: 29, Failures: 0, Errors: 0, Skipped: 0 -- in
org.apache.rocketmq.studio.auth.AuthServiceDatabaseTest
[INFO] Tests run: 16, Failures: 0, Errors: 0, Skipped: 0 -- in
org.apache.rocketmq.studio.auth.AuthServiceTest
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0 -- in
org.apache.rocketmq.studio.auth.LoginRateLimiterTest
[INFO] Tests run: 66, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
[INFO] You have 0 Checkstyle violations.
```
No login behaviour changed for a client whose username is a real one: the
added check only fires for a
name that is longer than the `VARCHAR(128)` column can hold, so it can never
match a stored account.
Note on the full suite: on a clean `rocketmq-studio` checkout `mvn -B -ntp
test` already reports
`Tests run: 3051, Failures: 6, Errors: 25, Skipped: 4`. The 11 red classes
are the MySQL 8 backed
Spring integration tests (`AuthServiceBootstrapIntegrationTest`,
`AuthServiceConcurrencyIntegrationTest`,
`AuthServiceSessionOverviewIntegrationTest`,
`HealthProbeIntegrationTest`, `QueryHistoryServiceIntegrationTest`,
`NativeAlertEvaluationTransactionTest`,
`NotificationOutboxMapperIntegrationTest`,
`RmqAlertStateMapperIntegrationTest`, `StudioApplicationTest`) plus the
external-CLI ones
(`CliAgentProviderTest`, `ClaudeCodeAgentProviderTest`). None of them are
touched by this change; the
four classes above are the ones this change can affect.
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in
- [x] Commit subject follows Conventional Commits (`fix:`)
- [x] Tests added or updated for non-trivial changes, test methods named
`...Test`
- [x] New UI text has both Chinese and English entries under `web/src/i18n/`
(no UI text in this change)
- [x] Architecture constraints stay green (`mvn test` runs the ArchUnit
checks)
- [x] New source files carry the ASF license header (no new files)
- [x] Documentation touched where behaviour changed (no user-visible
contract change: a username longer than 128 characters was never a valid Studio
username)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
