The GitHub Actions job "Build and Run Tests by Maven" on 
rocketmq.git/codex/mqadmin-password-verbatim has succeeded.
Run started by GitHub user iloveeyjafjalla (triggered by iloveeyjafjalla).

Head commit for run:
3487d58d665ab96d414a801a8280e9617a4d7460 / iloveeyjafjalla <[email protected]>
fix(tools): stop trimming the ACL password in mqadmin create/updateUser

The secret is a payload, not a name: the broker stores the secret verbatim and 
derives the
client's credentials from it, so a passphrase with leading or trailing 
whitespace is legal -
and pasted secrets routinely carry one. CreateUserSubCommand and 
UpdateUserSubCommand ran it
through StringUtils.trim before the call, which stores a secret the operator 
never typed:
every client that presents the real secret is then rejected with no hint about 
the
difference. The sendMessage body carried the same shape until #11414.

Drop the trim on the password only - the username, user type and address keep 
theirs - and
give both commands the createAdminExt seam CopyUsersSubCommand already exposes, 
so the
behaviour is pinned by a test.

Report URL: https://github.com/apache/rocketmq/actions/runs/38872738183

With regards,
GitHub Actions via GitBox

Reply via email to