You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "zjncs (via GitHub)" <gi...@apache.org> on 2026/09/09 08:31:16 UTC
[PR] Escape LIKE wildcards in cloud credential search so names with % or _ match literally [rocketmq-dashboard]
zjncs opened a new pull request, #4194:
URL: https://github.com/apache/rocketmq-dashboard/pull/4194
### Motivation
`MybatisPlusCloudCredentialRepository.findPage` feeds the trimmed search term straight into a `LIKE` clause over the credential `name`. Because `%` and `_` are SQL LIKE wildcards, a term like `aliyun_prod%` matches every credential whose name starts with `aliyun` + any single character + `prod`, plus any suffix — silently listing credentials the user did not type.
### Changes
- Add a private `escapeLike` helper (same behaviour as the existing `QueryHistoryService.escapeLike`) and apply it to the normalized search term in `findPage`.
### Verification
`MybatisPlusCloudCredentialRepositoryTest` — new test `findPageShouldEscapeLikeWildcardsInTheSearchTerm` asserts the bound LIKE value for `aliyun_prod%` is `%aliyun\_prod\%%` and not the unescaped pattern. Before the fix it fails; after it the class is green (6/6).
```
$ mvn -f server/pom.xml test -Dtest='MybatisPlusCloudCredentialRepositoryTest'
(before) Tests run: 6, Failures: 1, Errors: 0
(after) Tests run: 6, Failures: 0, Errors: 0
```
This is the same class of fix as the audit (`MybatisPlusAuditRepository`) and instance (`MybatisPlusInstanceRepository`) search paths, which also bind user input into LIKE clauses without escaping.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Escape LIKE wildcards in cloud credential search so names with % or _ match literally [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins commented on PR #4194:
URL: https://github.com/apache/rocketmq-dashboard/pull/4194#issuecomment-5694496154
Closing as part of consolidating the LIKE-escape work — same reasoning as on #4192 and #4193: a third private `escapeLike` copy (here in the cloud-credential repository, which also feeds the CSV export path) and no explicit `ESCAPE` clause. #4236 is the anchor we asked to be resubmitted.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Escape LIKE wildcards in cloud credential search so names with % or _ match literally [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins closed pull request #4194: Escape LIKE wildcards in cloud credential search so names with % or _ match literally
URL: https://github.com/apache/rocketmq-dashboard/pull/4194
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org