You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "btlqql (via GitHub)" <gi...@apache.org> on 2026/09/21 06:36:31 UTC
[PR] fix(auth): bound the login username like the user API does [rocketmq-dashboard]
btlqql opened a new pull request, #4684:
URL: https://github.com/apache/rocketmq-dashboard/pull/4684
<!-- Base branch: `rocketmq-studio`, the RocketMQ Studio trunk. -->
### Brief Description
`AuthService.validateLogin` (server/src/main/java/org/apache/rocketmq/studio/auth/AuthService.java:554)
checked only that the submitted username was non-blank. An unauthenticated caller could therefore send
a username of any length; the value was handed unchanged to `findUserByUsername` and, when the login
failed, stored by `LoginRateLimiter.recordFailure` as an in-memory map key.
`LoginRateLimiter` bounds how many usernames it tracks (`MAX_TRACKED_USERNAMES = 10_000`), never how
long they are, so the oversized string stayed reachable in that map for the whole failure window
(5 minutes, plus the lazy sweep) - the one place in the login path whose memory was not bounded. No
other username entry point accepts such a value: `CreateStudioUserDTO` (`@Size(max = 128)`),
`AuthService.validateUsername` and the column (`username VARCHAR(128)` in
`server/src/main/resources/db/schema.sql:20`) all cap it at 128 characters.
`validateLogin` now enforces the same bound on the trimmed username and rejects longer input with
`400` before the mapper and before the rate limiter see it. The check shares one constant with
`validateUsername` so the two entry points cannot drift apart. Anything a licence-holding client can
send today still behaves exactly as before: a username longer than 128 characters cannot exist in the
database, so no account answer changes.
### How Did You Test This Change?
Two new tests in `AuthServiceDatabaseTest`. The first pins the response (400, and no mapper call), the
second pins the effect on the rate limiter by injecting a `LoginRateLimiter` and reading its
package-private `trackedUsernameCount()` after a failed login with a 4096-character username.
Before the fix (red), on the unmodified tree:
```
$ cd server && mvn -B -ntp test -Dtest='AuthServiceDatabaseTest#loginShouldRejectAnOverlongUsernameBeforeTouchingTheDatabase+anOverlongUsernameIsNeverRetainedAsARateLimiterKey'
[ERROR] Tests run: 2, Failures: 2, Errors: 0, Skipped: 0
[ERROR] org.apache.rocketmq.studio.auth.AuthServiceDatabaseTest.loginShouldRejectAnOverlongUsernameBeforeTouchingTheDatabase -- Time elapsed: 0.032 s <<< FAILURE!
Multiple Failures (1 failure)
-- failure 1 --
expected: 400
but was: 401
at AuthServiceDatabaseTest.loginShouldRejectAnOverlongUsernameBeforeTouchingTheDatabase(AuthServiceDatabaseTest.java:570)
[ERROR] org.apache.rocketmq.studio.auth.AuthServiceDatabaseTest.anOverlongUsernameIsNeverRetainedAsARateLimiterKey -- Time elapsed: 2.531 s <<< FAILURE!
expected: 0
but was: 1
at AuthServiceDatabaseTest.anOverlongUsernameIsNeverRetainedAsARateLimiterKey(AuthServiceDatabaseTest.java:599)
```
The `401` is the base behaviour: the 129-character name went to the mapper lookup and came back as
"Invalid username or password", and the `4096`-character name was still tracked by the rate limiter
afterwards.
After the fix (green) - the whole class, plus the neighbouring login/rate-limiter classes:
```
$ cd server && mvn -B -ntp test -Dtest='AuthServiceDatabaseTest,AuthServiceTest,LoginRateLimiterTest,AuthControllerTest'
[INFO] Tests run: 9, Failures: 0, Errors: 0, Skipped: 0 -- in org.apache.rocketmq.studio.auth.AuthControllerTest
[INFO] Tests run: 29, Failures: 0, Errors: 0, Skipped: 0 -- in org.apache.rocketmq.studio.auth.AuthServiceDatabaseTest
[INFO] Tests run: 16, Failures: 0, Errors: 0, Skipped: 0 -- in org.apache.rocketmq.studio.auth.AuthServiceTest
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0 -- in org.apache.rocketmq.studio.auth.LoginRateLimiterTest
[INFO] Tests run: 66, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
[INFO] You have 0 Checkstyle violations.
```
No login behaviour changed for a client whose username is a real one: the added check only fires for a
name that is longer than the `VARCHAR(128)` column can hold, so it can never match a stored account.
Note on the full suite: on a clean `rocketmq-studio` checkout `mvn -B -ntp test` already reports
`Tests run: 3051, Failures: 6, Errors: 25, Skipped: 4`. The 11 red classes are the MySQL 8 backed
Spring integration tests (`AuthServiceBootstrapIntegrationTest`,
`AuthServiceConcurrencyIntegrationTest`, `AuthServiceSessionOverviewIntegrationTest`,
`HealthProbeIntegrationTest`, `QueryHistoryServiceIntegrationTest`,
`NativeAlertEvaluationTransactionTest`, `NotificationOutboxMapperIntegrationTest`,
`RmqAlertStateMapperIntegrationTest`, `StudioApplicationTest`) plus the external-CLI ones
(`CliAgentProviderTest`, `ClaudeCodeAgentProviderTest`). None of them are touched by this change; the
four classes above are the ones this change can affect.
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in
- [x] Commit subject follows Conventional Commits (`fix:`)
- [x] Tests added or updated for non-trivial changes, test methods named `...Test`
- [x] New UI text has both Chinese and English entries under `web/src/i18n/` (no UI text in this change)
- [x] Architecture constraints stay green (`mvn test` runs the ArchUnit checks)
- [x] New source files carry the ASF license header (no new files)
- [x] Documentation touched where behaviour changed (no user-visible contract change: a username longer than 128 characters was never a valid Studio username)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): bound the login username like the user API does [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins merged PR #4684:
URL: https://github.com/apache/rocketmq-dashboard/pull/4684
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org