Aias00 commented on code in PR #7741:
URL: https://github.com/apache/shenyu/pull/7741#discussion_r4303455903
##########
shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/NamespaceServiceImpl.java:
##########
@@ -183,7 +183,9 @@ public NamespaceVO findByNamespaceId(final String
namespaceId) {
public List<NamespaceVO> list(final String name) {
if (SessionUtil.isAdmin()) {
- List<NamespaceDO> allList = namespaceMapper.selectAll();
+ NamespaceQuery namespaceQuery = new NamespaceQuery();
+ namespaceQuery.setName(name);
+ List<NamespaceDO> allList =
namespaceMapper.selectByQuery(namespaceQuery);
Review Comment:
Non-blocking: `name` now reaches `selectByQuery`, where it is wrapped as
`LIKE '%' + name + '%'` via `<bind>`. So a user-supplied `%` or `_` is still a
wildcard — pre-existing for regular users, but this PR newly exposes that
behaviour to administrators. Worth deciding whether to escape it or just
document it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
