iloveeyjafjalla opened a new pull request, #11447:
URL: https://github.com/apache/rocketmq/pull/11447
## Which Issue(s) This PR Fixes
Fixes #11446
## Problem
`CreateUserSubCommand` and `UpdateUserSubCommand` trimmed the ACL password
before calling the admin API:
```java
String password = StringUtils.trim(commandLine.getOptionValue('p'));
```
The broker stores the secret verbatim (`AuthMigrator` copies
`accessConfig.getSecretKey()`; `User.of(accessKey, secretKey, ...)` in the
authentication manager builds the credential from it), so a passphrase with
leading or trailing whitespace is legal and is what a client must present. The
CLI stored the trimmed value instead: the real secret is then rejected as
unauthenticated, nothing in the CLI output or the broker log points at the
difference, and the admin API stores the same secret verbatim, so the CLI and
the API disagree about the same user. `sendMessage` carried the same shape for
the message body until #11414.
## Change
- Drop the trim on the password in both commands (the username, user type,
user status and address keep theirs).
- Give both commands the `createAdminExt(RPCHook)` seam
`CopyUsersSubCommand` already exposes, so the argument that reaches the admin
API can be captured in a test.
## Verification
New tests capture the password the mocked `DefaultMQAdminExt` receives. With
the trim in place:
```
CreateUserSubCommandTest.testCreateKeepsThePasswordVerbatim:65 expected:<[
s3cret ]> but was:<[s3cret]>
UpdateUserSubCommandTest.testUpdateKeepsThePasswordVerbatim:65 expected:<[
p@ss word ]> but was:<[p@ss word]>
Tests run: 1, Failures: 1, Errors: 0, Skipped: 0 (on JDK 8)
```
After the change, in the `tools` module with JDK 8 (`mvn -B -ntp -pl tools
test
-Dtest='CreateUserSubCommandTest,UpdateUserSubCommandTest,CopyUsersSubCommandTest'
-DfailIfNoTests=false -Djacoco.skip=true`):
```
Tests run: 6, Failures: 0, Errors: 0, Skipped: 0
checkstyle:3.2.0:check (validate): passed
spotbugs:4.8.6.8:check (check): BugInstance size is 0
```
The unit test is the verification for this one; it exercises the command
class, not a live broker. The change was prepared with AI assistance and
reviewed, tested and verified by me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
